{ "Event": { "published": true, "date": "2022-04-30", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-04-30", "timestamp": 1651363381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "32190802-ed20-4051-ae3d-7e4adc7fa9cd", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b495b7e9-c877-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651317699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317699, "uuid": "8b6ec3d6-5085-48f1-9d51-f2799a4e67d5", "comment": "Malware payload (AgentTesla)", "value": "0dc775f5cfae5aeecbbed5fdb9c45231", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317699, "uuid": "0417cc78-826f-4a1a-80ef-538ca66d8c0d", "comment": "Malware payload (AgentTesla)", "value": "017f3bbabbf2bd01276c64c8fddbd41d76e7dee05c6a4921bb5b795bb39c1f03", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317699, "uuid": "8e63059f-d5aa-4213-80e1-69fadbc36eb2", "comment": "Malware payload (AgentTesla)", "value": "71a9873dba54d52a53a4dfa1ae5cf0032228b5c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317699, "uuid": "15b82575-43e6-4bf5-bcaa-cf63055a1580", "comment": "Malware payload (AgentTesla)", "value": "12c12a571d14467f2ca451788eeb27a82cbdd95c5b2aa7b9bac4d24cabdb05e8963032b500f36376aaa0838c1ba8199e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651317699, "uuid": "ee2fff78-ba0e-45fe-a387-68878d0b9ab4", "value": "T1F654238405ADD986CC927FAD9DF7A227B325B0362B3229C016DE1F214AC4F69E70057F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651317699, "uuid": "9903d347-b9af-4b32-8431-7ce162a362bf", "value": "6144:ZVNGXlXR1rI8Uup9fSH4PLMTkZoS3Z5CO4+qrxRjqKbyfZmbZ6jlF:z4RR1rvJSYPWkZoSp4vlRjqKbr4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651317699, "uuid": "de3f88a9-7300-4f32-8376-09c7571b9716", "value": 283347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651317699, "uuid": "570b7587-19f6-4f1d-80b5-a6b8de6abde4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651317699, "uuid": "e7163453-3013-4458-99e3-a14ae6012f50", "value": "Order confirmation 5679021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5edbe90b-c8af-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651341607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651341607, "uuid": "65333930-e003-4b31-b77e-710e54d75fb8", "comment": "Malware payload (Mirai)", "value": "f28e10d051eb81f95679f89a2284632e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651341607, "uuid": "5023eef9-7375-4265-a141-ca97676b49b2", "comment": "Malware payload (Mirai)", "value": "01d51768aaabccafee6d522d1d456e1d93890510100ea8c6dba8d6eb44b4cc45", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651341607, "uuid": "77498e26-7004-47c3-9349-689105e5691c", "comment": "Malware payload (Mirai)", "value": "38896b3d955151e33975f25003ddf6e3c2986138", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651341607, "uuid": "d5a79ea7-d6d5-451e-84db-b20cccfc475d", "comment": "Malware payload (Mirai)", "value": "f22c1f5aed2367c41805e7dd242a1e9dc63370bd9e993a720d0d65ee8fec7ccafcc1921cd94d4cb0fc21fba4bc42cea7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651341607, "uuid": "0ca44e4c-7584-41ff-9955-e05194154351", "value": "T10092C0609792F5A0C6384C79C8B89D8B21230EF9D5F732352F5619D578D2A05A5FC383", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651341607, "uuid": "dd24eb04-c253-4400-b55a-6c0590190dc2", "value": "384:j543YzCnT4c4qan+mrPp1+uS05U6RlsAvyqJ+MnAb2nJVcKgio6ZdBhymdGUop5x:tI4c4JnrhsullLZAbaJVcK75dBs3Uozx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651341607, "uuid": "15d08e83-3b87-4be1-99d3-22f37bba35bd", "value": 20608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651341607, "uuid": "c8b1076b-7b40-49f2-a3f1-6dba4a7adbb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651341607, "uuid": "a46d9cfc-7375-467e-bd7b-7528011ac9d7", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c604c3c9-c835-11ec-8e58-42010a9c0032", "comment": "Malware payload (Tsunami)", "timestamp": 1651289382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289382, "uuid": "a03fc7fb-d268-46ca-a1cb-4a7c885d008a", "comment": "Malware payload (Tsunami)", "value": "0ba9e6dcfc7451e386704b2846b7e440", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289382, "uuid": "2159529c-8dc2-4c5f-a688-73aaea078260", "comment": "Malware payload (Tsunami)", "value": "02acdc11b6e22b8fa19ebafb10190ac28a7f0e5ee569a058c2df825337e4447a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289382, "uuid": "987e30b0-159b-47ba-bd3d-17f3cd7f55cd", "comment": "Malware payload (Tsunami)", "value": "6d500cc96fc97c43261c753a5c9011c6104d62bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289382, "uuid": "465120ca-42b5-4b00-bf44-9e5df8721ab6", "comment": "Malware payload (Tsunami)", "value": "bef622c709147f96d8474afadf7baadc54d0d9952c2d4b3f0e7eac67cb21826005aded2a27260bd6f9d7d29691359829", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289382, "uuid": "6b71b865-4aa4-4e2d-ba06-f20fe8522484", "value": "T1AD0412A6102EC5D2D260C5374887659F7D9AD88754F88E3AAD6C38080732B379CEDDDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289382, "uuid": "2835b597-7006-4586-9c87-61f492c51189", "value": "3072:s6Uqj4DHJo9gvgCTo0OPZbHcCpRah+pqsa8aCfOdZMHoO5UkwuDLq82o1DtrqT:s6F8DpSgoCuBnE5CJhpDO8fbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651289382, "uuid": "2d6519c0-f58d-44d4-ada4-4c0297b14ad9", "value": 179132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651289382, "uuid": "fdb66f12-315b-485e-a568-c2bc896b9f08", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289382, "uuid": "49e7ec67-4daf-4208-a1a9-268499b3a177", "value": "SecuriteInfo.com.Linux.BackDoor.Tsunami.1050.21810.19124", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e3c093-c894-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651330204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651330204, "uuid": "c637f43d-9072-40ad-97b7-639ad51ff1c8", "comment": "Malware payload (Mirai)", "value": "b653e6ca08dd9b6d128908edbd2a88ff", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651330204, "uuid": "cbb3a27b-4d01-4a4d-b641-1f14c1643a1f", "comment": "Malware payload (Mirai)", "value": "048b2ae6eefb24f3ce864dd900c391ad4c38b6d06c30d7918fa48a304fb314c1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651330204, "uuid": "3d5ac10c-dce2-4951-8503-7f493e17408c", "comment": "Malware payload (Mirai)", "value": "1a2c77ea35161c05a2b5fdb709a4d06831101dce", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651330204, "uuid": "1401bea0-b04c-4cd2-aaa0-835c51a816c4", "comment": "Malware payload (Mirai)", "value": "a8a46ee89cfd10b144441ae6c76a2c97bd7d0e28a0e087eb1383dfdd12cc87a084dbcd0e66ebfb821070bd715fa42281", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651330204, "uuid": "2117c26e-500b-4529-ae96-619672277127", "value": "T19423F1A1E31EE0D3C62798B6CC7F4780A96E1C5AD1FB701A04EB3558A39188F1B38157", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651330204, "uuid": "cf48834d-aeeb-42b9-9313-6e39f1d6a46f", "value": "768:95lpPa7beMGLDtWFuCLImiVKb0rmekqlE2x9q3UELuyTQPvfaYvCinHpr0:9JPa7bQ8BWr9+2kLNQPvDvCiJr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651330204, "uuid": "cae04b88-7760-41f1-a670-db9f174c6351", "value": 49000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651330204, "uuid": "650c2641-9271-46a1-ad5b-cd2273f0c18b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651330204, "uuid": "7dff32f4-ce2b-4ef5-b425-3b0bbce1a953", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35757cb-c864-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651309617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651309617, "uuid": "80421b44-7ea3-4cc1-a18c-25e9d97afc41", "comment": "Malware payload (Mirai)", "value": "48b125e625b409e86458e3a643a016c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651309617, "uuid": "c2370b55-c4df-427d-87cd-344c5244972f", "comment": "Malware payload (Mirai)", "value": "05d930619954cc3c260b75811e5fa57c664ddcc6222367e3887231bb7a9d9e99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651309617, "uuid": "abd70e68-9b23-4865-b24e-d2aae09d945b", "comment": "Malware payload (Mirai)", "value": "a64f02ed0eaafb81e38d5de88395cf4dd1f401b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651309617, "uuid": "b9fff53e-65aa-44a8-8234-959fecd7d0e4", "comment": "Malware payload (Mirai)", "value": "10e93a291ad1bd615512f5d431531c745afc6cb69a2cb79ff8c67a13676a7782aa0241f62308f905061f7de523c92258", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651309617, "uuid": "a8bdd6a1-6bc3-4246-947e-74731e47843a", "value": "T1E2C2E05891D96823ED740D79DEE6E0C1B66713FCE0FE3533B6006921FB69500637C69A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651309617, "uuid": "456b5cb9-70b7-4e4c-9244-cd3993584185", "value": "384:+kTSZNMURNAGqhrDwSgH7FxZc/0Zvp7QZjeKDvF7j0m7I2NNiiHmuhymdGUop5h+:+VNMuNA9hQBHp1gj3F7BIJ29s3UozHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651309617, "uuid": "8a986411-7ccb-4eec-a379-6f0846e87eb5", "value": 26104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651309617, "uuid": "22979854-7784-47f4-ab77-b59d2159a2bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651309617, "uuid": "1fa2b469-8482-47b1-92a3-a948c69466b5", "value": "48b125e625b409e86458e3a643a016c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a95cf1-c81b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651277889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651277889, "uuid": "1e7a0ca2-5bfa-471b-ab5a-79a23a339dbf", "comment": "Malware payload (Heodo)", "value": "7669394c9c9ce2269fc9bb4723bfd0a9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651277889, "uuid": "edd5fdc4-586c-4a09-9e19-61b6197619aa", "comment": "Malware payload (Heodo)", "value": "0626b21033ab353bb51049a6e19ea938d0c621110153d9158f0f468430fc003b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651277889, "uuid": "567ce9ca-f4a3-4ea7-a4a0-1864f07496f5", "comment": "Malware payload (Heodo)", "value": "b0df109d74dd03aa38ec7a2168de9b255b947c85", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651277889, "uuid": "a561c5be-393a-4a4b-9ec6-f3a2e3a737e3", "comment": "Malware payload (Heodo)", "value": "9efabbde4e7650c9480b889a607174473f1ab65854b78793c930d96632b1b0a2502fc427c306772daa214ae87a2b3565", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651277889, "uuid": "4231427a-fbf3-4378-91c0-ff7b0fdb1f41", "value": "T100C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651277889, "uuid": "11ce6425-decc-4067-8485-6d9ca3cf0fbd", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651277889, "uuid": "2f1bd47f-6b39-480a-b342-0330ad965026", "value": "6144:JhZ02GdOOgPYqKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFflKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651277889, "uuid": "d41604c7-84e0-4015-b07f-d839bae94d44", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651277889, "uuid": "543b50b0-6694-4174-b1ab-d0ace9f872f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651277889, "uuid": "745bdab1-c2a7-4d6d-b5bc-67f0f57d4f29", "value": "7669394c9c9ce2269fc9bb4723bfd0a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43dc2dba-c83d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651292599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292599, "uuid": "57a07786-c1a7-47ec-babc-f8db4bb05a43", "comment": "Malware payload (Mirai)", "value": "37c2e9acd54f2f6aefee677e0b5a1c25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292599, "uuid": "91311a1d-0d1a-4f50-933e-a681fd82b075", "comment": "Malware payload (Mirai)", "value": "067121def544c7bace6499b88c4a3bcb8571827c744ced6bb6d3c53d99489268", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292599, "uuid": "13a36bfc-0c66-4870-8d5c-d9d308a43d25", "comment": "Malware payload (Mirai)", "value": "592306634284e4e4f73d52c15a6d7d00926bc8fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292599, "uuid": "3467e7bb-1fee-4919-b850-dfb6418746d7", "comment": "Malware payload (Mirai)", "value": "e73b58719d7700d581138d6db1e38d5370ded0e54dabb283c0b384e7f3ff7f7ae819517fbdaeb637f179df397c34eb58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292599, "uuid": "60ba70b6-5497-4e9e-bbe3-cac51a95c602", "value": "T1DE73B70A7E329FACFBA9523447F78E11AA5833D627E1C585D19CD6011E7024E381FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292599, "uuid": "15cc6928-058a-4095-95d6-d48c37e96eca", "value": "1536:3IHb8FMv77EKQHlyZR1Fa6yBm3froxvdeEOPFal:Y78ivnEKMy1Fa6yBmProxvUPFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651292599, "uuid": "335ac936-5808-4968-9b9a-79529fee37ae", "value": 76672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651292599, "uuid": "191582c5-329f-4cd0-8ba7-8d9ed85f2ed9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292599, "uuid": "745962a6-c3c8-42dd-ae92-d85cf1135a60", "value": "37c2e9acd54f2f6aefee677e0b5a1c25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91b37106-c8cb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651353719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651353719, "uuid": "ab46c951-e7da-4e54-8097-1878bec70d43", "comment": "Malware payload", "value": "6415da5eeb7102dfb6147bcd3aa79eb3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651353719, "uuid": "5f7012cf-5174-4181-923c-7c060c5ef69a", "comment": "Malware payload", "value": "077225467638a420cf29fb9b3f0241416dcb9ed5d4ba32fdcf2bf28f095740bb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651353719, "uuid": "82e3e1f6-c7a6-47a8-8ac4-b7cc5e23c07a", "comment": "Malware payload", "value": "d231903de12e11e94f3b52c5b71fe8a6ecf30458", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651353719, "uuid": "ef1f8636-9f13-4f4f-9036-1e65131fcf7b", "comment": "Malware payload", "value": "6adff230acf8e2977b66dd42f33d7736f531cc5ca4b3a2212dcc82dc4c4e5f2ea65d01a7f8333bc1fcaef4588a9c2396", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651353719, "uuid": "c6436eb3-73c3-4b18-95a9-aae23f9eacad", "value": "T18C855A31A250F046FC67407ABD5622F75469253073D048FFEBC6A9B5A4A2BC6E338E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651353719, "uuid": "eb2b3a16-769f-4dcd-b870-80e8daf73fea", "value": "9717f652c4ea111153dd1446d725de9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651353719, "uuid": "3f4c4c5d-8a57-4ed4-af04-5063df0bda56", "value": "49152:goeP5E4muoLBVwt/eGNdWCqzwp/NjM1n/D5X16z5Qiu6sTTBGRi:goeP5E4muaBVwdeGNdWCqzwpVjM1nr5z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651353719, "uuid": "3fc09495-2a36-4a7e-8dc7-4f833a39b837", "value": 1805824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651353719, "uuid": "c9438cb1-4476-4be8-aedf-dbb77e178605", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651353719, "uuid": "c2f1847b-9dcb-45ab-a5f9-725b8704882d", "value": "077225467638a420cf29fb9b3f0241416dcb9ed5d4ba32fdcf2bf28f095740bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc5005f-c825-11ec-8e58-42010a9c0032", "comment": "Malware payload (ZeuS)", "timestamp": 1651282466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651282466, "uuid": "2eb371af-b00a-4a99-8f27-05938fd94e79", "comment": "Malware payload (ZeuS)", "value": "c5d14d1402090f41775019e8dd827194", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651282466, "uuid": "dd756de9-ef6a-4d39-94e9-5eda29ca5333", "comment": "Malware payload (ZeuS)", "value": "0798aa9b84cfc0805ba08d1c190d1f94edb3f2d1988eb6d6307b1af950e3d75b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651282466, "uuid": "f9b4c903-7bb1-4042-9d03-5d4bad6df3cf", "comment": "Malware payload (ZeuS)", "value": "7ccac9a21cf37b70dac4fc80e08b75494cddbd4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651282466, "uuid": "748ea8fa-ee35-44eb-8376-4e1d4a94ac7e", "comment": "Malware payload (ZeuS)", "value": "e579da2b9432076cff9ba8fbc932263786114c7656b3f75c1565c38c5ae4574674d33d02ad470d8cc8018149a6c564d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651282466, "uuid": "bb52c0bc-d174-4f20-9239-3abb7cda7236", "value": "T18314D0D3F6E38132F4BB057211332B2BCD76BB202A76C05E6A917D8A5F31751A526393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651282466, "uuid": "f25bad15-4dd7-4ae2-9942-6ce2eec033e1", "value": "d9f30dfacbc21d523f6bb324c4b8c92b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651282466, "uuid": "c0244f00-5a15-4d64-b78f-8e997249728b", "value": "3072:d7BfivAzBm1SJXLSasN2fKVOAIOXEwyhPjVwp760FdakoDwnGkT+QcOkJQqBv:hBh85D2CO/dNI76KakooL1qt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651282466, "uuid": "6e41c7cd-d8ae-45c0-8e90-cc24f8eecaff", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651282466, "uuid": "a7d4c02e-afb7-48db-b8c7-8c8f87654ce7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651282466, "uuid": "eb14c9d2-69f6-4b39-9a5a-5eb4b50ce278", "value": "0798aa9b84cfc0805ba08d1c190d1f94edb3f2d1988eb6d6307b1af950e3d75b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b040b2f-c83d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651292611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292611, "uuid": "09e283d0-3292-458a-bdb0-86b5686b9c2b", "comment": "Malware payload (Mirai)", "value": "8ff4a7c5b9c194f113986969563e6757", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292611, "uuid": "b3eda08b-3511-4939-b0d2-d221be106ffe", "comment": "Malware payload (Mirai)", "value": "0a12dfaa3ad62f63c60ff2c4b452cebcef6cfc674b604cfae77713af4a72db21", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292611, "uuid": "40027b47-ee8e-4dfb-9798-9e4164d57106", "comment": "Malware payload (Mirai)", "value": "772fce62c4392363cb59454561e73dca30ea1242", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292611, "uuid": "aa012709-b47f-41b1-aec3-a6e7e865a8ea", "comment": "Malware payload (Mirai)", "value": "a821010d464cadb9ec12cd3f13bc293231f97ba33cebcc20538d6c8f03227d56a740f449db914fd7ee13022cd2267ddd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292611, "uuid": "395f75b7-9b2a-448d-b9e3-1a3ff9468744", "value": "T1E4735A01B3584A47E5A61EF4393F1FE197BEEAC022E0F5856A1ED7465172E33484AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292611, "uuid": "4384b714-8bc5-42a4-a007-fb2928984d56", "value": "1536:DNpp9RXI1vgi0uvM8zomzNsKRyxOReqpNiSejOjNfXM:Xp9djCTomzNsE2Se6jFXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651292611, "uuid": "4595d820-d6ca-4168-bed0-e8aa191798fb", "value": 79080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651292611, "uuid": "44f63bc0-5614-4586-ba17-4298fb88a426", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292611, "uuid": "c411aff5-e5f4-4fe6-9b7d-b133bb561901", "value": "8ff4a7c5b9c194f113986969563e6757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6ee567-c88c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651326603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651326603, "uuid": "18a0f4ec-b7c9-4208-bbbc-da1897bac0ec", "comment": "Malware payload (Mirai)", "value": "08f82ee4034106dc4577da2915e82a2c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651326603, "uuid": "98cfbeca-9ba5-4842-a610-5c29094c5f6e", "comment": "Malware payload (Mirai)", "value": "0a6396aadc9b960dd61067809b3526fc4ac76530dd48a3105a98d7689c541acf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651326603, "uuid": "6fdaee43-4815-4e0b-898a-07fc08ba5e6c", "comment": "Malware payload (Mirai)", "value": "185ab4e2b4315693862ce2ca89e9fb7ca760f4cf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651326603, "uuid": "33908037-45b0-4c72-b2fb-98f9dcee345b", "comment": "Malware payload (Mirai)", "value": "631b32a4be15b6685f2671bb1e06f15dbfd56295abccc05f1728610d02921df8a12c65f0c9125ba84f7973e791fa2838", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651326603, "uuid": "20c4f2bc-91d4-4535-b8ee-517542463270", "value": "T13FC32A56E7818B03C4921779BADF42513323DB54E7EB63065928BFF43F827AA4E23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651326603, "uuid": "64aa2e6c-47e1-484a-8b2f-632305aeefe1", "value": "3072:K1aXISShs6i6XCDFqsiiiQ7M/9kMWmJwZeMzu:K1aXISSC6uFliiikM/9kxmJwZfzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651326603, "uuid": "7ced36f6-c7cc-4bf3-84a0-ab4d4121f822", "value": 119725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651326603, "uuid": "3940b27c-fe44-4cab-aa9b-4ddc67d88401", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651326603, "uuid": "5aef2b21-aa21-4c86-90e4-2726b5a6d05e", "value": "beamer.arm7-20220430-1350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314117bc-c83d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651292568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292568, "uuid": "b9185579-3cdf-41cc-89ad-f0aead73b5f2", "comment": "Malware payload (Mirai)", "value": "79b63e99f901917b41ae381828e10589", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292568, "uuid": "cffe80a2-d0d8-4786-b117-e9ccdfd7f016", "comment": "Malware payload (Mirai)", "value": "0c4424f034c8f320d8a0c3aff5c6e6524d85a7051c122b0295604ab8a4616479", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292568, "uuid": "ee44c069-e06a-49aa-9eb7-31a461d21df6", "comment": "Malware payload (Mirai)", "value": "281eef8d09a7ac04a994dc0635a611b4f1da3a3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292568, "uuid": "c2705350-4db3-45ed-885b-31210b108a34", "comment": "Malware payload (Mirai)", "value": "57927abdbdb8e6cb16fcc21ca1eb489b70816a3edb2257ed1f00a9aa26779a372f9f72509c1e3b8a50ff713824b2d586", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292568, "uuid": "17d81201-74f1-4b55-880f-96d4ee58d20c", "value": "T12C832A9AF400DEBCF88BD6BA41664D0EB930A39016920F367767FE933C23095D956D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292568, "uuid": "59a7e52e-9859-48f9-917d-ae2807800e62", "value": "1536:qLf0+QM5PHyVwi7f2lUiEy+DlOo7JL3Gfh8FG8fmLPR4oFGBOKEDbF+ym+j:qLaV5fQ+DMWSJ8FAGocBBum+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651292568, "uuid": "fd1f3f40-eef0-45bb-83d0-0e445868c4ea", "value": 84044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651292568, "uuid": "ed294bc8-7d76-4bb3-bafd-ddbdd7b3182e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292568, "uuid": "ed0ae2e6-2467-4654-ab09-cebbee6fa11f", "value": "79b63e99f901917b41ae381828e10589", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab1b0b80-c8ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651346460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651346460, "uuid": "430f2c07-284a-4f6f-be95-4a7b8a77082d", "comment": "Malware payload (Mirai)", "value": "d7093c216780b8d9c4a59844abda3653", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651346460, "uuid": "128217ed-3b54-4ca5-a740-8737f0d11048", "comment": "Malware payload (Mirai)", "value": "0d99d7dc9e4d7a6d93a123043b07e117c8a612448c68b20adffffb17e2a5a4fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651346460, "uuid": "0af0e0c2-0fc9-4099-9414-1c8508d3c788", "comment": "Malware payload (Mirai)", "value": "4a6020518419ed18691c9c0cb386f0cda66e68e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651346460, "uuid": "84f67b20-5256-4c46-9bf0-5842cabec943", "comment": "Malware payload (Mirai)", "value": "82811b4925f783fd493fbb0a5e01414adfa0cb91660aab660c37e27740a51638dab6cc278c4e3627dc11cebaf5243623", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651346460, "uuid": "c18ba8f5-537f-4c01-a662-31d7be93e6a7", "value": "T1E5E2E07A0611B399ECA244FE03A5D7A1BA3B8DE45C5B9C063709DDD2EE042783CD3AD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651346460, "uuid": "e6139c42-74c0-45d3-9615-1195f0bb5393", "value": "768:VtP8Jp01JipM+P4l0igTsiswgJUYulPWQgBV6b+PJgGlzDpUYs2:LP1UM+g+TsJwgOTkxy+NVqYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651346460, "uuid": "fee4abeb-1ab7-4b13-ba9a-96e23380ed31", "value": 31984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651346460, "uuid": "b3e7568f-86e3-46a0-bc12-b1175c033c2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651346460, "uuid": "eec8be15-e8c4-403a-bd88-26b06ea6ca3a", "value": "d7093c216780b8d9c4a59844abda3653", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb8d18d4-c819-11ec-8e58-42010a9c0032", "comment": "Malware payload (AZORult)", "timestamp": 1651277419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651277419, "uuid": "0b73c691-6082-4092-be22-93f1e115b29f", "comment": "Malware payload (AZORult)", "value": "17071d64615641e55bcf7bd6e073112c", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651277419, "uuid": "7facfbe4-d17f-4ca6-a3b7-7d7603bf427d", "comment": "Malware payload (AZORult)", "value": "0dbd2f4fb3fdb2aca6e0674929a4494408f467cf0daa5341b2baf22353f616dc", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651277419, "uuid": "72963dc9-4696-4aa6-98d6-f5782bc17ed9", "comment": "Malware payload (AZORult)", "value": "e96ecf99c5b7a0019a9a69e0055adf0e49a7181b", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651277419, "uuid": "742a8fa3-6a4f-4de5-b41f-5bf148e43f2c", "comment": "Malware payload (AZORult)", "value": "eacd1ef068ab66c682b6b07d91754ecb99c2a4650a160c98346c19751edc3a2905cde96e630647f44b2fe561a952dd39", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651277419, "uuid": "bd46289e-6402-4e83-9b7a-87935f62d613", "value": "T15FB3196EF7C19277D02408BDCD45A1B9907975302E391822F7E64F6CD8F96C2AA6C2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651277419, "uuid": "264dd2a9-432d-4508-9047-b96b31f90972", "value": "6d1f2b41411eacafcf447fc002d8cb00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651277419, "uuid": "2f71d057-2987-485c-9167-33c31533724b", "value": "3072:KExRaX6raoCoCyz6/mqv1JR+yBtGOeheWginVq:faZ1tme+1winM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651277419, "uuid": "861a88c5-5a17-4a50-9f34-9f7210ac8ed2", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651277419, "uuid": "3c401e63-119a-45d7-84e1-1299b618bf94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651277419, "uuid": "e8d53973-cb04-41ae-a846-33e0f933da4c", "value": "0DBD2F4FB3FDB2ACA6E0674929A4494408F467CF0DAA5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f2e8237-c862-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651308617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308617, "uuid": "8f96d6f9-79eb-4a84-837e-6fd10f667cfa", "comment": "Malware payload (Mirai)", "value": "38ae74aadb6a4bb7d0bb651528b9f73b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308617, "uuid": "0bbccd48-89a7-4afc-9c18-0242c6cba896", "comment": "Malware payload (Mirai)", "value": "10603143f82242829921b92fc1795cadd046a47af8aedd640e18735762f8f151", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308617, "uuid": "42f71ba1-bf2a-4971-a96d-b0f88d40d899", "comment": "Malware payload (Mirai)", "value": "be0ee45c8cf0749e548a2b66508ad96635cc01a6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308617, "uuid": "17daca1c-f0a5-453c-a940-d7f197e0d083", "comment": "Malware payload (Mirai)", "value": "2366bf05a9a15377f625d6a2e6b127f221a4fb0f726da5747ef659dce838cbde4855874022943df6356074c5fd83ba2a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308617, "uuid": "7c308a10-e7bf-4143-a14e-f1bc50bd9ca8", "value": "T13F533956B9818B13CAD052B7FB6E42CC372613A8D2EF73039D256F21378792B0E67651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308617, "uuid": "5a1ad535-7a65-4c07-8445-f00b63103dd7", "value": "1536:KQyrPvh1ph+6vohVlnUS+UuLb4shev3C:3yHmVpUSa8t3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651308617, "uuid": "513dfafd-3784-41d3-b66b-2ac464524376", "value": 63792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651308617, "uuid": "d5a15299-dcbf-4d9a-bc0b-47c82fc0dec1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308617, "uuid": "62f73b8d-5e6f-4e51-8fea-74199e7c2b05", "value": "Cronarm-20220430-0850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec77824-c829-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651284296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651284296, "uuid": "aa1f837c-c5f2-47be-b596-435a48373329", "comment": "Malware payload (Heodo)", "value": "80b7220f6ed8d86efb2dcf219f161b90", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651284296, "uuid": "79d2c77c-eb98-4058-a6ea-3737d6a5c1f6", "comment": "Malware payload (Heodo)", "value": "13aac460fa7d12cdecf05ab5bd9b68f2c67fd1e328dbf28209175cb4ca4fa1e9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651284296, "uuid": "10e9f363-2ff3-4cff-9b49-58bbe8c0ea6d", "comment": "Malware payload (Heodo)", "value": "b4473ce704e541991d458b33a76a4389a7b0d6d4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651284296, "uuid": "550dcdd2-b8af-4cfb-835a-a1558ca7ef4f", "comment": "Malware payload (Heodo)", "value": "d464bc542c5975e6a5010c47a10e59216a7ca6fca50fdfecc1d09c30b8b661e085d68f34c1a8016d13bc7f68c347fd07", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651284296, "uuid": "218727e5-ac19-4e81-a612-8848061a8736", "value": "T1D7C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651284296, "uuid": "fd994a47-f6a1-44b5-a7a9-9a2e96347338", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651284296, "uuid": "024727a3-202c-4bc3-a795-3e29738df24d", "value": "6144:JhZ02GdOOgPY2KUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfpKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651284296, "uuid": "d620f7ee-cbfc-4b29-85b5-72571cedefa9", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651284296, "uuid": "5ffe23e4-aece-42ea-ba36-b0ef74e95a29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651284296, "uuid": "c5a292ca-3edb-4bb9-9985-43fb798ed6f6", "value": "80b7220f6ed8d86efb2dcf219f161b90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82076084-c838-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651290556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651290556, "uuid": "bdc47917-613d-41f3-bbd1-aab896eb228b", "comment": "Malware payload (Mirai)", "value": "68bafde2616f544e74481a777f355563", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651290556, "uuid": "f7100979-047f-4786-b048-01dfd2afd4b5", "comment": "Malware payload (Mirai)", "value": "15157605e9641035993c76277be435d9da4093d9c2221f836180b6da3dbf119f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651290556, "uuid": "7cc83f06-bf0c-485f-a206-78399d4cd803", "comment": "Malware payload (Mirai)", "value": "498313a28e1b6544803ec17a71f29128547b7464", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651290556, "uuid": "0d12cc1d-311f-4c3c-be23-e0301aa77349", "comment": "Malware payload (Mirai)", "value": "9fba1c58ca762cf9e327617281c2e94f4837e01e45adcfbcefeb417180cea5ba6cd0d0a2725b40e9feaae175db2e6582", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651290556, "uuid": "4b36765a-4f76-46cc-9d0d-59b3c9fa4e8c", "value": "T1A0735B24A97A2E26C1D4A17E62FBC321F1F6230E25B4961C3CB60F8EFF1465464562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651290556, "uuid": "bd35b0f8-7af2-479d-97fa-a599119fd4ad", "value": "1536:ubHmkTSo3BOIqS5aq+Dc03oR9QuEk6vNNicKzf6Fx8:kmcjaq+DccoJ+vN4Fzf28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651290556, "uuid": "57cdbf6c-b753-4792-8d5d-abe09ec4fe96", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651290556, "uuid": "a85e6c93-a7e0-4efe-9ab9-5e3dd6e48132", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651290556, "uuid": "f164c4d8-7524-43ec-861d-8b0f91081c12", "value": "68bafde2616f544e74481a777f355563", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9fe08f8-c82f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651286811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286811, "uuid": "a2a0dcab-4b9a-4ce7-a219-8c327e219961", "comment": "Malware payload (Mirai)", "value": "8abcecafad4a4551fea08bcd10a93c0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286811, "uuid": "7fe5ba96-287d-4c02-9093-1535e5b89838", "comment": "Malware payload (Mirai)", "value": "162e806048c1fff7b7b75191afff1fc014dc9475732436426c189a1ea31f5e4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286811, "uuid": "49eee9dd-e540-4a39-a630-aa1f2d7b1445", "comment": "Malware payload (Mirai)", "value": "e48cebd9d8f467ad431b2d52e6d24d05d931f66e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286811, "uuid": "55baafd0-da48-4c7d-bee8-8c6eff0c6241", "comment": "Malware payload (Mirai)", "value": "e8ad1cb68d92059f4e1c24aa9424ad666633876d914b387551fc9640c7008d7888602d2923ca3b5b9436d2ee2e7711b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651286811, "uuid": "81ed2c80-33d7-4aef-9309-3b13e4cc0e08", "value": "T184633A8AB401EEBDF9CBEABA80121D0EB520630150930F37B767FD937D721A19957D4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651286811, "uuid": "b38f5c76-9fdc-4f60-ad2f-6fe608e46448", "value": "1536:IV11ElUQc+cYlX1393BOI58lzf25BEtobK3O:5jDzjYIBKjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651286811, "uuid": "95bd933c-8c8d-4024-8486-eb6a619fe82c", "value": 66748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651286811, "uuid": "5e31c2fa-7553-4b78-81e0-84e33c48b611", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651286811, "uuid": "bcfaebc9-547a-46d4-9085-b0071fe44c8e", "value": "8abcecafad4a4551fea08bcd10a93c0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eabc74a2-c829-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651284289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651284289, "uuid": "9ce5dabb-c842-42ab-82b0-bec38156a9bb", "comment": "Malware payload (Heodo)", "value": "1e4033a7135b6b3de6f2999172e0b835", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651284289, "uuid": "9f647193-dc18-497f-8cfb-6f7ab99a9b2f", "comment": "Malware payload (Heodo)", "value": "1761730d5ad9734ee0be9cea959b47d36be36decea9016e4814404bedae193bb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651284289, "uuid": "9f9ade61-d0ca-4076-8a3b-fecdc76af62e", "comment": "Malware payload (Heodo)", "value": "d2257d94ecb2a5ff78388729657fe6eb26d0cf97", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651284289, "uuid": "f246476d-4f73-4b93-9ad3-56abf036ea11", "comment": "Malware payload (Heodo)", "value": "2565620ef7194a2253734839df88daa16b67fff148c5b89109357be4de6f44cbedb6c37438228feedcb4f134832b6d07", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651284289, "uuid": "7cb684c3-9aa3-4d85-af12-6cf838332a81", "value": "T1F1C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651284289, "uuid": "111c4761-7e31-4a2f-9f4e-e0002f48fea6", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651284289, "uuid": "767b4cef-ba37-4ea7-b8ea-feef0f2f8d8d", "value": "6144:JhZ02GdOOgPYWKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFflKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651284289, "uuid": "8f97b481-867e-4607-adbf-4b97918bc57f", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651284289, "uuid": "9f9d5c55-28a8-4f51-a3a3-000a377c8581", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651284289, "uuid": "a1482504-dfd9-455c-ad88-965090c7ac35", "value": "1e4033a7135b6b3de6f2999172e0b835", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec085e7c-c82f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651286869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286869, "uuid": "efe683a7-a355-4bb3-8c8e-c8f9ebcd21f1", "comment": "Malware payload (Mirai)", "value": "a3901115cb90bae6197794b25d98d8f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286869, "uuid": "8173324a-c8e9-442f-be3f-5beb5033bb9a", "comment": "Malware payload (Mirai)", "value": "18f41def17fc34bc296393e8d0716a34996fb12169b5807abd036b97429ce866", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286869, "uuid": "13aae370-5f3c-41fc-b473-28c8a98e3534", "comment": "Malware payload (Mirai)", "value": "f1cd4a1eee9e93493e97c664fc2e27faa18c40a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286869, "uuid": "a3b6d84d-01f5-448e-a399-471b0d58f560", "comment": "Malware payload (Mirai)", "value": "d538c9585d79781caa5a8d28900f9abac1d9c6515fabc8e11de09e0de725e8170f4aa6377ff1109258ca750c50b9bd3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651286869, "uuid": "a4fd25dd-69f0-4e59-8dbc-21ba73d64d38", "value": "T1D4734A24AC7E1E26C0D4A67F61F7C262F1F6230E21B4866D7C710F8EBB54680A656377", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651286869, "uuid": "bb369d97-8b84-4147-b14d-189693210777", "value": "768:Q0hpdo9/Y87y6xFgdWOrBn8WOP0b3KW9uiWaOIgieOycr3eQyOdeueNP66GLOyH9:DdU/Yky6xFgYODDgiekrO1b2UKnVHtwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651286869, "uuid": "82c42756-ce66-4e55-8620-c69c26650cb8", "value": 74892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651286869, "uuid": "4e54eb0e-a913-410e-a936-9f2c50e64201", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651286869, "uuid": "dac4a69f-e8fb-4168-a353-8bdc905c92a4", "value": "a3901115cb90bae6197794b25d98d8f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b1fce24-c851-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651301255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301255, "uuid": "8e2af714-2d2d-4795-ae0b-4498f1a8c29e", "comment": "Malware payload", "value": "060d5ff0dc1c843ac6044384771a3c8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301255, "uuid": "721fac77-26a4-4c4d-8a56-d9ed7c2a022a", "comment": "Malware payload", "value": "1961579c97a91da8b402ff15afe2374de4bce763ff2d9ac9458a9d99db2dbae1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301255, "uuid": "765c372a-b7c5-49f9-9747-83f9fa2030c9", "comment": "Malware payload", "value": "1eebe690fb7e67bb98945f64b231c8d08ffcfbdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301255, "uuid": "2c34259b-7258-4702-99b3-9713cf17d52f", "comment": "Malware payload", "value": "b90ff224189fa04c3221d7b90aacc9b54ad29cbe8b976f51a142f6cdb6029c27aa48f53eaedae6d5038f9a8281438e63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301255, "uuid": "a53eb4ef-ac08-46c0-9aee-d054b4fea8cd", "value": "T1B70602FE6148376CC01AC934A133BD19F2B6555E0AF9D46D73DABA807F7F421A202E49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301255, "uuid": "25642b91-d6aa-45df-b7ad-d44a5fc12116", "value": "bb46f1abb2c1ede95f964a725f9d1284", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301255, "uuid": "bcbdb722-6e15-4b51-9802-d3c06810ef92", "value": "98304:fNDzXEeA4bexo4AnlzSUZI/qXoEEfazNFA:fNDAH4buo4An4LyKy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651301255, "uuid": "c3815a61-f3da-4796-b4b3-dd85b49df6eb", "value": 3769344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651301255, "uuid": "25ddd8ab-2128-48f8-b75b-01e3cd45d4d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301255, "uuid": "7d7546d1-44b6-4a37-b4db-382fb8ce851c", "value": "060d5ff0dc1c843ac6044384771a3c8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "507673b4-c869-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1651311518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311518, "uuid": "937aabd1-ac0f-4091-be2b-08c7d7bf28d9", "comment": "Malware payload (AveMariaRAT)", "value": "47c75230daef3b0ffb1ee6e3abf6f8cb", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311518, "uuid": "56fa3f2c-d48f-4df0-9a17-d4acde7464fe", "comment": "Malware payload (AveMariaRAT)", "value": "197dc919f8177ebf900e2d90d6543bb2650bff52f5620ee6d74fb8af60d45c9d", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311518, "uuid": "5a143ce5-1fd3-4b57-961a-303ebb98bc12", "comment": "Malware payload (AveMariaRAT)", "value": "e85d88db246ba6db46eea4ef5722d5706368e0c0", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311518, "uuid": "2ba50c65-2dd2-479a-bf3a-ee847a98a85b", "comment": "Malware payload (AveMariaRAT)", "value": "16c2284445c2385a84e086c80d9851d53b756fb03b900a1531e39fe6ef243e8f0c3f291494baeba28b114ed8609e90bb", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651311518, "uuid": "afbb69d9-42f1-462b-a49f-f793cc9dc389", "value": "T1AA62C0AD5F0F0297FA7FB4B48C3A570E184557BC39F517E66C73300AEA2289104651AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651311518, "uuid": "01225250-14d9-4dc7-b5e8-aac85de47663", "value": "384:RtCJIg5/TUZC0f5h//BqRWr1cVsdIUVsyvetbVJysTQmh4PExGj:SJIg5Ajf5hwR0TIUVsbtpJ7T7h4c6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651311518, "uuid": "71253689-487d-4de2-8934-2f53ba8bb52a", "value": 15614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651311518, "uuid": "fbd92cc0-3406-468a-aad8-42ff618c4048", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651311518, "uuid": "4ef16f39-5ff7-4f6b-be6c-c60734d86f39", "value": "Invoice submission 7573 PO 133306.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8dc3c6-c853-11ec-8e58-42010a9c0032", "comment": "Malware payload (BitRAT)", "timestamp": 1651302117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302117, "uuid": "528bfebb-8955-4c2d-8166-5930396130a3", "comment": "Malware payload (BitRAT)", "value": "0ceae356fe06d225808fd8a55989182f", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302117, "uuid": "c6e89585-19b6-4666-a22d-3409152beca0", "comment": "Malware payload (BitRAT)", "value": "19887dd6c10f6be508d784ffba9b12f5e216c970c3e899c68277df5f9aa92cc6", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302117, "uuid": "74ce95ca-bf6f-427b-81f4-f3664c45ec5f", "comment": "Malware payload (BitRAT)", "value": "5092e9004e38c73dab4611c3baeddc97ec7a73e3", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302117, "uuid": "2c96aa57-1912-442b-b513-06de8b7d154e", "comment": "Malware payload (BitRAT)", "value": "7ff84fd6a4fe2eaa7419432bec74d549ffdff7ee31dcc64542f4c262caf63757e694071e0487eca9061e60e81a16866c", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651302117, "uuid": "0e09bf3b-24e4-4b35-a0d8-62fba587f5cf", "value": "T12061844D102DF3C77751D49B9780D91A6ACD62EFFBAE383D2462D4D20601A97A02AAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651302117, "uuid": "65514a74-5bf1-4830-bd6d-a8ade3c3e0e9", "value": "96:EA3CZztsEGA70IBknMMRs9fXLaXLUYCBXXLh:JyZztsEGA7XMq9J3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651302117, "uuid": "e5b8aa82-5837-4b9f-aabe-1101226630d8", "value": 3294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651302117, "uuid": "6f757548-2658-4dfb-a057-c389f1b8c4a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651302117, "uuid": "75c17014-72a7-477b-8c83-91f733e707e0", "value": "CHECK#9182726.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d669c9c-c851-11ec-8e58-42010a9c0032", "comment": "Malware payload (N-W0rm)", "timestamp": 1651301232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301232, "uuid": "146804be-4ac5-4413-9281-99fd07214537", "comment": "Malware payload (N-W0rm)", "value": "51b8ac3ebe170777bfcedb54a8994a6b", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301232, "uuid": "950fcfb0-20d5-49fe-b3c6-039a74303a7f", "comment": "Malware payload (N-W0rm)", "value": "1a38a85710c15a41abe1cbc1d16a13a807707a7b73d490897bb241485cb643df", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301232, "uuid": "97162251-9960-4dc2-a350-ac4726a4928c", "comment": "Malware payload (N-W0rm)", "value": "4c813a8c266e9aad36c0c8d4b71b0191c8020a13", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301232, "uuid": "056a72f1-7f3c-49f5-bcdd-e3163c58b642", "comment": "Malware payload (N-W0rm)", "value": "3101652bb740978664fed22fa62d1659b7dfce12dab01861727cd43b51c0024a6c8720097295776d4a1a413a360fa4ae", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301232, "uuid": "4ab645d8-f960-4445-8eb2-8efa9868e0c6", "value": "T1F74108A36FA32465EE61243382049C47A5827D7A28DCBD7B1AC6A530AC11E2B1B57290", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301232, "uuid": "728f7019-5cbf-4292-a99c-e22552a78a92", "value": "24:9jlnr0YKq7fk5MGg7gSmEICA/+l3CHWzL3L/mYWPZIMYvQjWHdb1WgX/4Jl9x:9Zn015MHLxA/eq4b/sPZI3vQjWH1vkL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651301232, "uuid": "c279dc7d-8a3a-408d-9e79-94b71695de66", "value": 2302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651301232, "uuid": "f138325c-07cd-4e3a-b2ab-d820773a52b0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301232, "uuid": "8d9ac9a4-4333-4c82-90a7-4c101dd79c0c", "value": "ASNQSKJPXJLKFXSIEUQYZ.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c33613be-c818-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651276922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276922, "uuid": "8c976b04-8145-4db6-b481-14bc757a0495", "comment": "Malware payload (Mirai)", "value": "428c0277eee1fc353c21d2572657c4fe", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276922, "uuid": "a316485f-d968-45cf-a311-8d3e4f347cd1", "comment": "Malware payload (Mirai)", "value": "1a9271f6da8de8034a540027f5a3e12a8db7bee4dcbdf0198bb7bfd647322054", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276922, "uuid": "69f42982-b3cf-4b76-889c-662f37c2755e", "comment": "Malware payload (Mirai)", "value": "eca89149edc9113fc734c7fe5474d17de6f760e9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276922, "uuid": "2daeb4c0-6487-4982-a57b-8d63ea2504dc", "comment": "Malware payload (Mirai)", "value": "4c6a88c142604517d700c2dd6919c1e3f2983dd8f1f7a6e9c3bc9c13a070ea02278a6a6f5d6383a4c6cd9a90f3c03e48", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276922, "uuid": "8f0cf6d2-090b-43fe-b7e9-816e70436832", "value": "T117F2E1A1BD1D8284D3AFD437CAAE7D9595005748827875F2AAE028BB6F72B157700393", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276922, "uuid": "6cb1fc19-84d2-41b3-8511-4b895432b4b0", "value": "768:d2lmq4LL6evsahSmMKFmhcwOP+OdhwpzpQcXlt1WEZnbcuyD7UVyqq:d2lk6oBhOKYhB0+Onw/QcXlqinouy8sJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651276922, "uuid": "d0177ff8-9b97-41a8-a74a-d5ffa6c5494a", "value": 36724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651276922, "uuid": "8dff4de3-87d8-4ee5-a3ad-1ef2adbb18d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276922, "uuid": "b7e003c8-8f38-40ec-8742-a10013c37f5f", "value": "db0fa4b8db0333367e9bda3ab68b8042.x86-20220430-0002", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4208b5-c8af-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651341606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651341606, "uuid": "be798c6a-bde2-4ef3-b402-7e9efeb8b181", "comment": "Malware payload (Mirai)", "value": "f70af01810b7c2d483bf15180a28909b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651341606, "uuid": "ce997465-68d2-40e5-8a38-868455e6381c", "comment": "Malware payload (Mirai)", "value": "1c9eaaed9af1c5eaf7ec184ca90004ea4a265cc036e4ad7d3e50e89af078b67e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651341606, "uuid": "6b013786-af38-4a78-a74f-18c33db080ae", "comment": "Malware payload (Mirai)", "value": "95a21c7eef798c9abc42df9014c2688a35e6c1ea", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651341606, "uuid": "3ecb25ea-fc61-4a4f-a66d-349c5bab031d", "comment": "Malware payload (Mirai)", "value": "062737a99116260ad2e4e9ea518ecf9961363ecd06094cfb46d29e08b3dba62d79fc8230a00bd93c164e4b8b6540b6a6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651341606, "uuid": "2bf5460f-ca16-4708-b010-88817c5abe56", "value": "T1AC23F130DB13EA76B1D80A72BE685ACAC56E2ADC346B313350ACC5486B81D1D4FF5E53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651341606, "uuid": "40cc56d4-1c61-4dfc-b37e-f77cf3d809e1", "value": "768:cXczh3zgbGEXUFItVRrCKo6/a49q3UELUnotQ0j2e0woJXp7beXXAL4:cXcebGEzRrD78LPOe0HJo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651341606, "uuid": "4f5708dd-fc6b-4714-9883-8b4553c46c4d", "value": 46096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651341606, "uuid": "3189945c-370d-493a-b1ca-734ce82b9bc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651341606, "uuid": "28ce8b12-7e63-4bfb-9b78-aff89a86d717", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874fdd7a-c862-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651308604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308604, "uuid": "dea0baa4-283b-4dc3-98e2-1eb19fcc0783", "comment": "Malware payload (Mirai)", "value": "a77d6c284848f6ae60acc46a70e315f2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308604, "uuid": "33bf4f2d-57f3-4796-91ec-ceaa67260ea2", "comment": "Malware payload (Mirai)", "value": "1d0bdad1ab5ee20dce0c264c9729d2f3616c8dd3ae8c47d2c5a63fdac9578a5c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308604, "uuid": "fe87befc-be4b-4caf-91a8-594636f272f3", "comment": "Malware payload (Mirai)", "value": "062742bd06b792c0d0abfbeb167b7a11cf3512a2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308604, "uuid": "28651220-ad07-4746-a2b0-a45723cb0bca", "comment": "Malware payload (Mirai)", "value": "4f6d8ee3a249c261b6592abc765f4dd6845ca113be335a5bfb1eaaa69de3da0010c51d4ccbcf10e2fb1fa265195471cd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308604, "uuid": "fae8fa50-5b4a-4ad4-a6b1-9076effe7a29", "value": "T1F9D35C46FA408A13C4C61B76FB9F420A3322D755E3DB73069D285BF43F86A9E4E5350A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308604, "uuid": "7d449b7b-10c8-422e-9c7a-f4e83df24d18", "value": "3072:RImCfq4mnhMrHOadApOQqqR8WP9pFbLoDimQM/9bR:RvC6uiadApOQqa8WP9UDiRM/9bR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651308604, "uuid": "52da26bf-7be8-46fd-b47b-8bd5794560d1", "value": 142850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651308604, "uuid": "26696eaf-1699-4e8c-a52e-56c464933289", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308604, "uuid": "72939eb8-4384-427f-a4ac-a092cccb7158", "value": "arm7-20220430-0850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c7b6f5-c862-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651308605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308605, "uuid": "4b1c6d2c-92dd-47a1-9533-73633be225f5", "comment": "Malware payload (Mirai)", "value": "dae29f42e2aa3b789434143e1c757b0a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308605, "uuid": "2a6beb5c-7837-4c8a-9431-c7673451f7ec", "comment": "Malware payload (Mirai)", "value": "1df8e7e5bf6a6e3c1d100967cb67c65b418fbdb6d75c0596efe6d8562ad55d39", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308605, "uuid": "5e46ceea-768c-4333-9297-5cfd7ab8e483", "comment": "Malware payload (Mirai)", "value": "fadb91ec6e9b312e32043d7751b49d3d730441d9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308605, "uuid": "171c00d3-5954-4ce9-a400-5f4116c725f6", "comment": "Malware payload (Mirai)", "value": "7fe447d04b7e3121dc17dd41b62166ca14ebc9731ea1117dcbaf64746ac15a95bbb43b89268ea1e8df7bc010a7fb3a9d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308605, "uuid": "9c647326-cb20-47f7-ac18-114ac8489449", "value": "T1453302F1C70FAA80A825E434C96D888D1AED56F4D3FC71276318F73A1269AB709B3545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308605, "uuid": "be7ca48c-1d65-40f9-82de-e1390efd1d44", "value": "1536:Fnucar16BXIg039gKtNgwePKvxSLjMgE46q65sMS:FnkrIu9gbweVLon4L65S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651308605, "uuid": "a89bdec2-bd63-4666-96f6-82f8850acf17", "value": 54928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651308605, "uuid": "fbf42252-1b14-47fa-b05f-9c3823b234c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308605, "uuid": "621be9c5-80f1-417c-8da0-10f378738c42", "value": "Tsunami.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32a5c5c-c885-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651323817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651323817, "uuid": "524c76f9-e66d-4bca-b487-def08052ce87", "comment": "Malware payload (AgentTesla)", "value": "9d0364e1f625edb286b0d5541bb15357", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651323817, "uuid": "96e0e080-83d6-4220-9228-82e50584136d", "comment": "Malware payload (AgentTesla)", "value": "1e16a6376135e64593198e07872a0c8d8dfef6e988f11b6ec25c7c56845f6e88", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651323817, "uuid": "da58a95e-b673-43ba-8a3d-5e535686ba1d", "comment": "Malware payload (AgentTesla)", "value": "b5d75e7a381e3051839245fd8741533150c0afbf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651323817, "uuid": "a0a9dd58-d981-4efe-919a-00f729430216", "comment": "Malware payload (AgentTesla)", "value": "a6708a0a10f43ecd100f8728a87a2e5be8f534f9cb5b03dee88e9099d4e22d35e001bb62333f37aa9f28af5092469fb5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651323817, "uuid": "8f5e7653-c066-4ebd-8082-f6aba46a417d", "value": "T192A423C7A6457ADBCBE40AE83C7BF8832C20443E6FB94EF6947751BA1F0488C661C915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651323817, "uuid": "1d3f200d-119c-45a3-b7eb-b194a7424403", "value": "12288:eiCFLsHVhrH6CtFoB2alh0V9X4okWx2L7BEzzpAS45:LsIvH68oXl6D2L7BiSS45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651323817, "uuid": "98997775-6ed9-4d0d-8543-f353b6bdeabf", "value": 484614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651323817, "uuid": "66f417b4-ad42-4e70-96e0-5883a2ddf4c1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651323817, "uuid": "350817bc-dc74-459e-af84-57ae210fedc2", "value": "QNLNSAHMD2202897.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5a7ca7-c8a0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1651335292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651335292, "uuid": "40963dfd-5a34-41f2-8871-7e92cbef427f", "comment": "Malware payload (Smoke Loader)", "value": "de46900239e31d9eb442d7256ddd201a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651335292, "uuid": "17c57717-14bc-4005-a40d-5cfea98b2878", "comment": "Malware payload (Smoke Loader)", "value": "1f855acc222ef5dfc8790da73775a4f4b4d9cf5219de3b7600a53926af2b2652", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651335292, "uuid": "96caf03a-9c3d-4e68-a75b-235331b04042", "comment": "Malware payload (Smoke Loader)", "value": "198fb830016d5c66459dbb5168d297595289e794", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651335292, "uuid": "059059c1-370c-40b3-9080-dbc230559093", "comment": "Malware payload (Smoke Loader)", "value": "645f1ad3207448c0713a7b271d9eeb374bd95c1ebee03ec45dcbc26ed6b8a276c5980842bd94bf4a94988e5733c7d5fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651335292, "uuid": "06f2b22f-159e-4e45-a76d-d9db997807aa", "value": "T1E9F51252B784D9E3C80C1131685BA76A2F71AC1B3E03B7AB3348776E5EB23C67B01559", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651335292, "uuid": "7b9feee0-926b-420e-8c70-b431a6cab292", "value": "d601758053f82d0d8dce8999e7ecf803", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651335292, "uuid": "01053b93-7766-4480-a649-79d124ce88ef", "value": "49152:O0lWxKyYL+GInolv2VEUPBWd+ztjZhFq/4hQP6RmdYMqgSa74tYHBJh133Ean/Ob:X46dInolvW9M3SakWhJb305tfKGnONeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651335292, "uuid": "8c3c8a5c-fcd0-4d8a-8c30-1f985c1d23be", "value": 3392560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651335292, "uuid": "a2e9155f-7a32-4433-9ef9-01ef58ccc51e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651335292, "uuid": "e97b1ace-5e41-41b3-8112-2b2c7d4d9689", "value": "de46900239e31d9eb442d7256ddd201a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbed36a4-c867-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651310867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651310867, "uuid": "88024dea-4992-4bee-90e5-d3b66e5ecf42", "comment": "Malware payload (AgentTesla)", "value": "eeeed325e39dbf905e7b44f3fdee8452", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651310867, "uuid": "1fb8d466-8e2a-4f57-b4a1-de59a35b9d54", "comment": "Malware payload (AgentTesla)", "value": "210393c34b5a795a7582623f2d114cda56b93cb37d1b7bc656743512e4767bf0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651310867, "uuid": "66c1e40e-12ef-4c1f-bec6-2c30316f4936", "comment": "Malware payload (AgentTesla)", "value": "21bf70451991b9e9bc4df58aea06b3bf1558b586", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651310867, "uuid": "84cfa88b-a5ca-4a6e-99c2-700f71b0302f", "comment": "Malware payload (AgentTesla)", "value": "7eb65d7a83b6e2e6d823854e862200dbb20bb76e8dcb30bbb5d4e46537363450219dfb89685593cc90ad2c52708d8f2f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651310867, "uuid": "dd9f20d9-64a6-4f3c-8242-422626a6301f", "value": "T171D4232A5C76EBE23396BD7379601DB342E92523194713DE26B77A77AC0628D03C3D06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651310867, "uuid": "d88201e4-5f3b-4efd-b6c7-9eb11729e1c2", "value": "12288:8MhH6akTDBxOOvLCL7UPSqJByxnOY+LMlK79aZ3rGDK+Zhp38ZpHSis:87ao1FCnCJB8nOYqMlK7E6DKmP38ZNSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651310867, "uuid": "20dd74c1-acbf-4b80-ac5b-0afd01a5a3cc", "value": 605220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651310867, "uuid": "49a2fae1-0ae6-434a-9bdb-072a419a293e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651310867, "uuid": "2622874d-0d09-4e18-8a61-bf6f292d4ac2", "value": "Analysis. Xls.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b284e0d1-c8c2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651349908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651349908, "uuid": "5d808423-5589-4359-a3b9-dbc4b8abdcca", "comment": "Malware payload (Formbook)", "value": "ff123063e605766005ace71c43d9ac88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651349908, "uuid": "ad479b6f-1c6d-4e89-b177-9645a387c7bc", "comment": "Malware payload (Formbook)", "value": "21e106922dbeaa3aedc9d57ec11ad646c4a788d9399ae49e4a75c4344f4c6853", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651349908, "uuid": "6dd9c9ae-5dd1-4f9f-88ab-745fcfbece69", "comment": "Malware payload (Formbook)", "value": "1e245a38cbbd1e2812314d459f7f708c28f6f2bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651349908, "uuid": "41a032db-c630-4898-9859-3366b927a2f1", "comment": "Malware payload (Formbook)", "value": "48233fd774aba9a20fcb083d2277f9bff0a3c84d8b21ab6d4ceb33214b3a8b23f3144070d744db2d3c663750c42c6afb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651349908, "uuid": "2bab1b0c-3636-4c1d-b7b2-d31bdf9e174b", "value": "T19D14029431A09853D0B51B306E3A1399EBFA161715B1470B57407F5CBA3ABC2DB1E3AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651349908, "uuid": "630889f4-af32-4466-a8fb-a771457232c4", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651349908, "uuid": "5e26ef6a-1563-4278-af07-641d0314bdf9", "value": "3072:l1NjcVVnLpPunb6+wsMNhPjC9MupGKZLYR19YZev6IUYHYZ/rlgY0EmVrwgy97qe:HNeZm6LJzFQGt19Pv9UYq/iEfqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651349908, "uuid": "f9a862a9-d174-4476-905d-e79a0e7c66fd", "value": 196669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651349908, "uuid": "3d4eb143-a337-4df8-ae04-ea663b85b4fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651349908, "uuid": "35c547ac-4860-4d0b-a194-562941d7fac5", "value": "shedy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef9078f4-c86e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651313933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651313933, "uuid": "83c6df3d-36b7-4cab-8a45-4f684d0f0583", "comment": "Malware payload (Heodo)", "value": "64c3d647cfcfdc2c9af100f70abbbae4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651313933, "uuid": "1efdcc9e-d46d-4cf8-9913-7f31dc5d0bf6", "comment": "Malware payload (Heodo)", "value": "23a1b8b6a4077b4744d6cf35a66c9ef2663a28e7d9c53b979220f101af9cd86c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651313933, "uuid": "c814810d-586e-4d7e-88b1-f1be4739e9d4", "comment": "Malware payload (Heodo)", "value": "bc04e3eff427927d7f9a118bc9086bdbc4e62966", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651313933, "uuid": "8e7af6f7-988a-4e71-a8e2-b15d65fc6d05", "comment": "Malware payload (Heodo)", "value": "48b31cf4c4a5866295d55b923f893d6b95c53774260089b24a4c099c9cffe72d1b0967c8e8cc3404a21e22449e07fcbb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651313933, "uuid": "3927c1b5-66cd-4b90-ba61-289313d193f5", "value": "T122246C91ABC654B5C36230B14697333AB2ED83746B396BC75B942C319F780D2A93C71E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651313933, "uuid": "e04581e5-f72e-48c8-9c5e-8aa0c38b7590", "value": "6144:JzyKSPnEifm5GB/bl6xlWhWYxPS3aRXysKu0k/:JzpSPnEifD6xu1XRie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651313933, "uuid": "2afa568b-0e8b-4e74-b107-e8690821132c", "value": 216957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651313933, "uuid": "34276cdc-d4e8-4278-81e9-0327d6c1eb03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651313933, "uuid": "44230a23-4a10-45c5-bf23-d4f628325e99", "value": "emotet_exe_e5_23a1b8b6a4077b4744d6cf35a66c9ef2663a28e7d9c53b979220f101af9cd86c_2022-04-30__101848.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5740152-c835-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651289381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289381, "uuid": "6cfd9561-68fb-4348-8169-52d17f53f8f9", "comment": "Malware payload (Heodo)", "value": "2f26ed43f00663e587be4de66bc76628", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289381, "uuid": "7363c0c3-a6f2-41f4-ba6a-d4532d6450c9", "comment": "Malware payload (Heodo)", "value": "24085ca063867b992c62d459c48f5aceaa886559db75d963e303f43ff2d54f20", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289381, "uuid": "533498cb-19f7-43b7-a6c7-ba57b1709e60", "comment": "Malware payload (Heodo)", "value": "ea9f189c805428775bc27d7ffbd939fe3b365137", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289381, "uuid": "7ad520fa-6bca-4e16-b1d5-fd87b3a478a2", "comment": "Malware payload (Heodo)", "value": "e64132200a9555601dbbd83973b0fe7921a2d51f047dd07be9c4688e7632c9d22a2d033b7c28f01d53e703b9a59176d9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289381, "uuid": "9d72e719-5651-4cf9-8b42-c5557485a0e5", "value": "T1D7C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289381, "uuid": "a2a6d772-300a-493f-9bba-e62f35ec5ee4", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289381, "uuid": "845acf4d-6a0a-47c1-9432-89d616d055ae", "value": "6144:JhZ02GdOOgPYLKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfoKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651289381, "uuid": "f108e15b-f41a-44a7-a2bd-244d29460da2", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651289381, "uuid": "6114b752-a949-4e3d-afa4-d6a186001dcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289381, "uuid": "0e279c55-1e8e-478e-8ade-987488cd4d4d", "value": "SecuriteInfo.com.Trojan.GenericKDZ.87125.28817.8259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "739c94b0-c866-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651310289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651310289, "uuid": "cef207c6-c2cb-460d-8318-b586d64fb1f1", "comment": "Malware payload (Mirai)", "value": "11e6cb59f745aa0ef3d932dc999d0063", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651310289, "uuid": "25e578b3-3df5-4e41-aa10-01f7354663f1", "comment": "Malware payload (Mirai)", "value": "2636128287689e6e77dcd89a2b40f7b0e6b38050f823875f33afcf1eae64a411", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651310289, "uuid": "4880ee4d-f60e-4bc3-9b30-e86f525f8b7a", "comment": "Malware payload (Mirai)", "value": "842a14f2a5880c5a108b13c3de028b6e362cf759", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651310289, "uuid": "36ba9569-cec0-4fd7-a5f3-96de7b688829", "comment": "Malware payload (Mirai)", "value": "9b475b7a222e0d7c96727efa808cfaaae5263b1f2f4677215bfc1f4b2b3f69c4bcecfd6b5ebe6f49637afcf895641b3b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651310289, "uuid": "3dc5bdb1-de3a-4854-9978-bc4a127c1e83", "value": "T131838D31AD792F57C1D0A43B02F747A5B2F11B8E29E88A0E7D710D1EFF64A9060271B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651310289, "uuid": "e7b590f1-6b44-4827-819c-e6e7e20e4d3b", "value": "1536:8BGrdF0iuN4PumV5/8myf3r/vvzgGUpUUiprf:X7umDKfLH6pUUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651310289, "uuid": "dfa7a3e9-6764-4cf7-9065-c39605a36346", "value": 82992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651310289, "uuid": "d9b21ceb-3da1-4208-a5da-ddea73e91754", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651310289, "uuid": "96cb3aa4-d7ef-4f53-afa2-71210436915b", "value": "11e6cb59f745aa0ef3d932dc999d0063", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02553e6a-c824-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651281752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651281752, "uuid": "9421fb82-0bc3-42ed-81a4-4386dd13f77c", "comment": "Malware payload (Heodo)", "value": "07ee150b3ad4309bacbad43d8f5c5137", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651281752, "uuid": "cb90d0a5-7761-4d32-9227-58f96f71d911", "comment": "Malware payload (Heodo)", "value": "276b68d67abe4a17a48d582ca298bf4aa6a94a6ca230ee075dacd3105b2494c5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651281752, "uuid": "f0e21094-e5cf-45a0-93cd-e293a4318155", "comment": "Malware payload (Heodo)", "value": "a7fac4308d917afbcc9be9de9230ef380d559768", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651281752, "uuid": "6b08c576-27df-4247-9256-47801b107b1c", "comment": "Malware payload (Heodo)", "value": "668e6b3362bd3d57a361a44a1cb082cf1a6223764b1eada554a73b29da7f62eb290d49df96f9b54b5c1257f92695fc55", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651281752, "uuid": "b56b0b46-fc2c-4c5c-847a-d4e162ccb544", "value": "T16EC4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651281752, "uuid": "b4492886-d70a-40ca-b630-63956af31b6b", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651281752, "uuid": "c9b1324b-04af-4615-a4d9-a4ca7091a45b", "value": "6144:JhZ02GdOOgPY+KUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFftKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651281752, "uuid": "27e575ef-ff81-46c6-8570-a05a9f9d457f", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651281752, "uuid": "c1f363a2-2dd1-473e-bc6a-78e41cff6d46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651281752, "uuid": "5b9c19bd-5cc8-4b92-9ac0-edcfcfda26b0", "value": "07ee150b3ad4309bacbad43d8f5c5137", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae4a8cf0-c851-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651301368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301368, "uuid": "0673bd2a-a635-4338-bd18-e307773aab7c", "comment": "Malware payload", "value": "5d866dfd819c787570c24b3e7376e433", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301368, "uuid": "8f1351b3-87d6-4efe-ab7f-cb90d7f95679", "comment": "Malware payload", "value": "27c2f94c2bb4e129735d76ffe8427edc0e4668437793dff00181226ab14d3c58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301368, "uuid": "ca2ab7ef-2900-4641-bdc2-d57d9c0bb61d", "comment": "Malware payload", "value": "e3ef1812ab47ae79110611ad6bc9eb416ef1f14a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301368, "uuid": "4930e5af-9a95-49ad-a40f-9ac27a421b03", "comment": "Malware payload", "value": "da38fa4e2da93ac90e842c196bb1b69b341ed1c6de499258e8929b0f4cf9124c85aa2405bb25e4b66f5ce7df9ce2be08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301368, "uuid": "cf12b899-5cad-4bbe-81e5-7e05d058ec6b", "value": "T10684BF41BB50D039F4B726F0B9B6C368A53EBDA09B2450CB62D63ADE5A316D0DDB0347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301368, "uuid": "aa25f0ff-fe1a-45a3-9af9-b3b316fdbf15", "value": "a5e21eb4da4d713aa6e028b6a31293af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301368, "uuid": "11280241-e284-47a7-b089-72c715525f8f", "value": "6144:gO9gx0APsBwNCJgNWcPIl/pDxmLgPnMJFXzQlswAzMOg:gO9G9kB0+gNWcPCD8LgfMJFXzJw4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651301368, "uuid": "2745957f-1726-41f6-92ce-ece2086086b7", "value": 385536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651301368, "uuid": "13e122c1-af24-4d16-8535-b9463898e91e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301368, "uuid": "7aed1f6c-9a7e-4af2-98b9-174b37ebe2b5", "value": "5d866dfd819c787570c24b3e7376e433.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c208e36-c83b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651291835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651291835, "uuid": "50b60209-baf5-4b7e-87bd-f4ea0f5e4fde", "comment": "Malware payload (Mirai)", "value": "738b0844d48e96ccf70b88d6c8e6f463", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651291835, "uuid": "6bc41fd1-1ad6-473d-bc4a-5951ca60957d", "comment": "Malware payload (Mirai)", "value": "28f7cb880899625212d97f8b1e18da18ade42530089b4af08ecb483a21f62d42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651291835, "uuid": "dec7db4d-86a3-4848-a477-a12af241ab86", "comment": "Malware payload (Mirai)", "value": "2f67ad24dd50965ff24ebb07e9664e7034ca5e94", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651291835, "uuid": "7ab6113a-6790-483f-876e-22d9bc667a1e", "comment": "Malware payload (Mirai)", "value": "7aa08fc08bbaeffb480c799b860972ab2912c9cb65bbb41c608495663738d133feed1329a37a4bcec01e6840130803b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651291835, "uuid": "e63d69ea-1348-48f5-b38b-530e944398b4", "value": "T1C7F33C46EA418B13C1D71776FA9F414A33229B94E3DB730689286BF43F87B5E0E17909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651291835, "uuid": "c29c56fc-a99c-4ba7-89f1-7ee2b738e9a0", "value": "3072:dUW6GNytShMwHh4uaWGLKWdwffuSFYEJPdslWM/9OalM:dDVytdsSuaWGLKWefDDJPds4M/9OalM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651291835, "uuid": "f2083f88-e332-4f1d-8a88-88f86a43a380", "value": 165371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651291835, "uuid": "94e13e99-b133-46a5-8f76-5d708a2fe65b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651291835, "uuid": "739be34c-bfa1-45a2-9072-5db29465835e", "value": "738b0844d48e96ccf70b88d6c8e6f463", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c87cd5-c851-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651301221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301221, "uuid": "a5e45125-e621-40bc-b354-c7475903321f", "comment": "Malware payload (AgentTesla)", "value": "01b238e9e663f367543c3ff1a386cb39", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301221, "uuid": "680252c5-56d1-4fe9-a500-4696b1febbe4", "comment": "Malware payload (AgentTesla)", "value": "292bca26d6d8854a2eeca4eacecb4ea4f089a4a8347922a2cc8f6bd0a9221c58", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301221, "uuid": "6496efc6-1236-4546-a52a-9091004159a3", "comment": "Malware payload (AgentTesla)", "value": "53eb5d695eb2da8bb476567a510f3333db184c3a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301221, "uuid": "126bde3e-e519-41aa-b7a0-e256d11bd48d", "comment": "Malware payload (AgentTesla)", "value": "ce0cf5c734ed6f10f638df28b0164e59b899ba86706eacb072ef4d9143d964e177e62824c9961172acfd7a42ea860c7c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301221, "uuid": "9c932e34-169c-4992-8151-21c32a9d3128", "value": "T18594231F792C6982862A3178363E11A5074C13D6FFA2E8D8F81FC8E795499ED095BCF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301221, "uuid": "2c2b0b35-9c5e-4936-a082-e8bec73223fc", "value": "12288:R766dcqUSgwUyQCZsD2W6aDmJmtQop443Qi0:N66yxmUFa9a6kB3QL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651301221, "uuid": "f6a03d7e-72ee-45bb-b6eb-7b6ffc94f652", "value": 418402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651301221, "uuid": "c6c6bdaf-baa9-43ed-8d42-703ea9300858", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301221, "uuid": "7980089d-deb4-41db-9ce0-94db7e7c739b", "value": "Remittance Advice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6cca87b-c81d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651279021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651279021, "uuid": "f93e7bed-a332-4c93-ae46-0005253b282a", "comment": "Malware payload (Heodo)", "value": "7a0f673c299d59dd2f268e80e8c6c326", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651279021, "uuid": "7d9f02a3-6258-450a-a090-89d5c58993b4", "comment": "Malware payload (Heodo)", "value": "2c4242d19d03a23d4a4edc4d2840755177b3d03f86e6add9596dee8bff411409", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651279021, "uuid": "39f335a5-47d6-43bc-9287-6bde709ac78c", "comment": "Malware payload (Heodo)", "value": "6157f0098bc5402e03adf1a8567df6b6b4ce3471", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651279021, "uuid": "a772e250-b7f3-45a4-912e-bb09b3a44740", "comment": "Malware payload (Heodo)", "value": "781c70e3e2a0aa2d4881f9182606d1e019c2fe240a6b3ac16b21feaef4fb9bf70337768fa22a915389f605630f33d396", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651279021, "uuid": "0da364bb-192c-47b9-a1df-f974906cbfd8", "value": "T1F4C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651279021, "uuid": "7bb58bd7-c051-4922-9bf1-28e1c7674f08", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651279021, "uuid": "a0ebcf0f-0cb1-4998-8d69-9a0e81be8a66", "value": "6144:JhZ02GdOOgPY8KUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfTKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651279021, "uuid": "cedcd092-18b8-4dc7-bdd5-0e1f1181c8f9", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651279021, "uuid": "505470fe-fd68-4b2c-a482-63478a46b139", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651279021, "uuid": "f4619acb-0bc3-468c-af67-a2915491c028", "value": "7a0f673c299d59dd2f268e80e8c6c326", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc0849f-c873-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651315805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651315805, "uuid": "ad6b72fc-fbbf-4017-be50-dc415f742314", "comment": "Malware payload (Mirai)", "value": "e7f54b703de463fea81ccaae29fd16f5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651315805, "uuid": "136db824-64cb-4d3e-8602-ae75cdff1ec2", "comment": "Malware payload (Mirai)", "value": "2cbe9937ebc528f73350400fba0f8e0a4d688573dea736fa82b082eab293399d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651315805, "uuid": "e743113d-c707-4c09-99ab-dd24aa6e755c", "comment": "Malware payload (Mirai)", "value": "814236fe922c60b84c361c89363aca1224837a2f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651315805, "uuid": "53c8ee99-98e1-48b3-8c81-4437d7237487", "comment": "Malware payload (Mirai)", "value": "3c65f5dc85d2424a3007aaa630c85d86059b0142d43964faa033c288836c6c5bc2e023e7bc149d65dd3de59ffcc81a55", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651315805, "uuid": "1c1579e9-e33c-423c-9926-783e55f698b2", "value": "T130B2E18FABA70F67C052027E677F026D6C3A2CE64DA6A7413D53E380C3469076D76D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651315805, "uuid": "c482fe24-6ab2-4e43-a6ac-0e96f1a435bd", "value": "384:MOT44eyTGkYNxGdfVlHz4PiLvG27Xz8TR1Lti2OYuOeb1IdR5lD5Lv1RR:hc4VTqxufVlTbLOEYTvLt7uBmdRDD5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651315805, "uuid": "50823623-136a-40e8-8b52-26a83a782277", "value": 24756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651315805, "uuid": "bbc0edb0-20ba-4416-bf7d-4568e1aed5b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651315805, "uuid": "ac693159-0eec-424e-97a9-833cb0a4c021", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d383ce4-c83d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651292588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292588, "uuid": "c2fb8264-5976-470e-9067-b31e429c33d9", "comment": "Malware payload (Mirai)", "value": "62a9ad27ed3ecf163d60bd61bbb8d799", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292588, "uuid": "eacbe9d1-129d-4850-a4e9-581c98fb8396", "comment": "Malware payload (Mirai)", "value": "300ad42e7429f6ff7da6d1a73ad05d4366b46c94a4e34394eee1834d1d6c03ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292588, "uuid": "e69a9e11-9716-4f2a-8f1d-6c8984fba57b", "comment": "Malware payload (Mirai)", "value": "d7dafcbc8dd9ba3c858850149791c30a1eab67cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292588, "uuid": "e0bdb3fd-35f4-4798-89e3-f9197152568b", "comment": "Malware payload (Mirai)", "value": "04a11a0a9335d78b71938336236af328103d733df58342d51716668c0b9ac463aa177770cbdc411795666cae38c825cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292588, "uuid": "49fd8a6d-20d7-4458-bff9-5a55a65ee4f7", "value": "T1DA932986BC419A11C6C21677FE2F118E331257ECE2ED73138D245B707B8B91B0E6B95A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292588, "uuid": "726416ce-839b-4953-b710-293c64c874b1", "value": "1536:XhnRcUWoXufJ4Au8YKzvh/J5zVMcOsaUl9aFmLbRMIiEg188Qxc/5SYG:EUW+lAuG1hMR50awg188Qxc/E1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651292588, "uuid": "d07d8b40-b0ad-473b-98f6-ec03b30f4a60", "value": 95476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651292588, "uuid": "dd383f66-1e99-459c-a822-c52c5310c77b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292588, "uuid": "58e8f740-ffd7-4b8c-a916-9bfee31b28de", "value": "62a9ad27ed3ecf163d60bd61bbb8d799", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd5930a0-c8ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651346490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651346490, "uuid": "315c5cd8-dc5f-4402-8857-1a9259c24d97", "comment": "Malware payload (Mirai)", "value": "2fc9a5d6b751af04a91cb6ffe403a614", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651346490, "uuid": "5abaac2d-24ff-4084-9a40-f0ac90d1fa6d", "comment": "Malware payload (Mirai)", "value": "312f696b8a4a114da4aae858f7c8d7055468fa791a67d7645a7dbdba6be537ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651346490, "uuid": "77e7013c-6872-4413-a37e-eda6c3cca145", "comment": "Malware payload (Mirai)", "value": "9286b2c0c6ad461d60b9ebc5d20e37ab2fc666ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651346490, "uuid": "adb720e6-1274-4ffa-b2e1-a48bf61a0b04", "comment": "Malware payload (Mirai)", "value": "ad194cef9fc2fc24d5ffb7ba7f5a7c07721db08c0a300fe1658d268e8afc347f680669e3de2eac6aaafd14121883ad7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651346490, "uuid": "facef63d-c3e0-4b65-994b-a1298d56b864", "value": "T17CD2D005F4EC4EA3D34F53BDD95A0ADF5A7046145A9CCFE9650CE0832DB13A2D31A88A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651346490, "uuid": "2c7fa59d-9b89-4107-9983-455d68fca752", "value": "768:wPKGQsgjmSbpAkbiSuQc5ilxm0XVv308gPTKb:vOemSWkfcACGfe7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651346490, "uuid": "8ff5bb4c-e427-4ccd-a59c-0821b88a64c7", "value": 30068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651346490, "uuid": "78dbfa76-a539-4eba-bde8-2a103fef92cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651346490, "uuid": "e8c39c33-93cd-4779-9dce-d95c3a24b022", "value": "2fc9a5d6b751af04a91cb6ffe403a614", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb4b4ce-c864-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651309551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651309551, "uuid": "cf07c8be-c8ee-43fc-9c21-02d48683ca24", "comment": "Malware payload (Mirai)", "value": "ed396f888195ebd78823d63d8c0f78af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651309551, "uuid": "2b62acd7-d30f-4156-ad44-8f5578f1306b", "comment": "Malware payload (Mirai)", "value": "32262f5316cc2e853e5d102e5f149429f0cf439016dfd1b58c3105d5982804f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651309551, "uuid": "295cb053-d05c-46b9-ae72-3ef98f716bce", "comment": "Malware payload (Mirai)", "value": "8119ce4f464c0a3d588ae65ebabc2a22e6dba687", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651309551, "uuid": "e73decec-0d08-4a9d-af99-04646d98552e", "comment": "Malware payload (Mirai)", "value": "01c6424593b64ecb9c54440d0394d470d85f4462fb6ae0ca325327e70cebac43c90083f933b049bedc622eb72067c94e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651309551, "uuid": "bb05281f-dd97-4943-9688-93f07359db02", "value": "T191E2F1A4A71150A9D73DD4761DF48BF82CA00A55D142CE86B138D0CB9F471E6F9A739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651309551, "uuid": "11ceaa85-6b3b-44a6-8259-0911ce0c83b3", "value": "768:YFzUDz0+fNhuITuM9oI+5XwC7GK32kXEeVeyJgGlzDpbuR1J7:YRUfZnuMm/eWpXfe2VJu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651309551, "uuid": "84bff4d3-cc14-48bb-a8bc-01a8f387f060", "value": 31948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651309551, "uuid": "74b18b08-9eba-4137-8e76-0e3a229d0cb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651309551, "uuid": "5d45e0d1-ad62-4cd3-b7c6-7e0e16d0f78b", "value": "ed396f888195ebd78823d63d8c0f78af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f8fde9a-c89a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651332616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651332616, "uuid": "0efa81dd-68d6-42ca-83af-a90d30c6efc1", "comment": "Malware payload (Mirai)", "value": "c70dfcbc411176334ee7463f4484d82f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651332616, "uuid": "5bbf95d2-3f14-496b-87f0-38db142bb380", "comment": "Malware payload (Mirai)", "value": "333e76f41dab02de137c8a87da5b5ec461cbcd7874456bfbcc8ebe9f914d8ae8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651332616, "uuid": "3427ebe1-7526-4f65-8a77-6888ec6734d8", "comment": "Malware payload (Mirai)", "value": "79dd62bedabc4e07acc14d36f5c9586ea49d5599", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651332616, "uuid": "1456c017-e154-4fbf-afa6-53939caa7758", "comment": "Malware payload (Mirai)", "value": "a61515a1e1dc935567ec9a4c1490292ee09898613230050ff6dd7f82c9ed2afa4f135d7c0cf1fe07ced448b731a4b3e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651332616, "uuid": "f238ab02-4d5e-4e4f-841c-d2f7dfaf0eae", "value": "T1C7D2E018B2A14AE1EBB11D76EEA1424CE50E0FB470DF3121AAA09774CAD262D5B358C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651332616, "uuid": "87e86915-243a-4c30-bd2f-28ca78abb4a5", "value": "768:Ph9XbjWynxFgIBvypZZ4VNmozzwr3o/4yUBaNP6PAO9q3UELl2:PbuyPBnEoc2Sa16ozLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651332616, "uuid": "bc1629d8-e708-44ce-90a4-b6077e882b09", "value": 29468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651332616, "uuid": "55c8c69c-8311-4aad-8ea7-b6ba12794427", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651332616, "uuid": "3626fd89-1b6a-4fe8-83b9-2e76b47ee51f", "value": "c70dfcbc411176334ee7463f4484d82f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcdef6cf-c82f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651286843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286843, "uuid": "d017e22c-9653-4ab8-b004-a6895e0b6e8c", "comment": "Malware payload (Mirai)", "value": "04f10b755e4362fd50fa1a04a7172485", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286843, "uuid": "dc414c21-efdf-4238-af64-4416bbd9a2bd", "comment": "Malware payload (Mirai)", "value": "33b08bd85b6657ac578c91e36363cb4629112c8e0cc00707e65b02cdc6800ba4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286843, "uuid": "e4fe64c6-fd5f-45b4-a1a1-101b8fd498a0", "comment": "Malware payload (Mirai)", "value": "c91d75135f1bb546a8442885209e21a949a368c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286843, "uuid": "2d5641d0-a99b-4984-b542-8b9abc75cc5c", "comment": "Malware payload (Mirai)", "value": "95a374c8d4b5510dbd9bae727d5185aca70405b98e440899f5ed8060558369474deca2127ab7e3e1518d942311747f85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651286843, "uuid": "a75e8f10-4c10-47be-b48d-51d82cd095ae", "value": "T16853AE76C2B92D68D0688A74B914CA749313A504A5D37FF9D642CB39800BEFCF605BF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651286843, "uuid": "8d0fe125-960c-4aa0-8715-bc4ebf6a486f", "value": "1536:MaOK/NrA+cYesCKdodZx0rrnszl+sWZ6FgQCvWkO1L:MO1ZKsCi+0rj4WZs9mWNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651286843, "uuid": "9396a833-02b3-4f97-b0c4-e68fa755b36b", "value": 62652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651286843, "uuid": "21f1c151-26c6-4ffd-aa50-b388548339e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651286843, "uuid": "4a338988-605b-4068-a6ff-5f6467d6d263", "value": "04f10b755e4362fd50fa1a04a7172485", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7878a1f4-c8a7-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651338214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651338214, "uuid": "616740ac-ebc0-4fc7-a37a-e5425280554b", "comment": "Malware payload", "value": "650b3b7ec6a0ccead7d903c372339886", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651338214, "uuid": "2e067a86-c907-49f8-9a1a-64c0d53731cd", "comment": "Malware payload", "value": "33f8e61a09d26ac3304508e03675feca0140f4e36b5ed89d9876cfaf93bc8506", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651338214, "uuid": "e442cb7a-0761-40c7-baf1-f9ad8a7096e6", "comment": "Malware payload", "value": "aa4e2c9e9b762f6e6f91a56d3a68fdeb2dcdd927", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651338214, "uuid": "c7ee94bf-f75f-42d6-ad75-438a6ee7308f", "comment": "Malware payload", "value": "caa20091e29c2217b7cbddff2f45f31075a6e70c39d7f1d4269e5a7ae6da867a49eb4aff3ef18fd838ab3456ba03ea91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651338214, "uuid": "38faf518-3f73-46fa-a3f8-8483321f3eff", "value": "T13EF51252BB80C9A3C90C1135584F6B5B6EB0E4173F07B7A73349A36E6EB23C63B41599", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651338214, "uuid": "75e3baf5-5ccc-4fc9-b735-36192ac1cc22", "value": "0760a503f7a7077fda83b52209440655", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651338214, "uuid": "c70f4725-4340-4efc-8dad-8bad601815b9", "value": "49152:hQQ5ECebxr/Hda3hZdWd+ztjZhFq/4hQP6RmdU+VSolqAZpiJh133Ean/Ow6NtfB:/Cho3hUVjViJb305tfKGnONOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651338214, "uuid": "cfe13d3c-cb65-48be-84dc-f35f62be7b01", "value": 3334248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651338214, "uuid": "c1860982-d593-4d84-8e07-82fbe1f6eb97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651338214, "uuid": "7c8414d2-2b43-4320-a649-785417c69def", "value": "650b3b7ec6a0ccead7d903c372339886", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a33b913-c857-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651303723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651303723, "uuid": "408fb3d4-200f-4919-a4c0-de3b17ebe858", "comment": "Malware payload (Formbook)", "value": "c7f6bc1e4446e8679865321b81398542", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651303723, "uuid": "f26b6d39-8fbf-4290-889c-7cf66f58e0d2", "comment": "Malware payload (Formbook)", "value": "3411706ef9d8c435a75a0982c58d3297c3faf12d1201998bcd1b21499f3d6a9b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651303723, "uuid": "767ba9e7-db4c-4ea4-9257-7c913a8b9145", "comment": "Malware payload (Formbook)", "value": "4daca6c2674ce99e9839533e544a21acd83dfc88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651303723, "uuid": "28be1b7c-da0b-41e7-9bbc-fc86ff429f5b", "comment": "Malware payload (Formbook)", "value": "0d32223c36772fc4f180fcdb40da36c2979c7b213b33dd6d97f4b4fdf1a265963bcb1649c7c87aff45266c4bd843a6c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651303723, "uuid": "0ee675f8-f32e-47eb-8464-e510669c6afd", "value": "T166C49C072E5CB6D6F96C4AB91862E27477B8ED946D20EE5A1AF03EDBF130704C510A37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651303723, "uuid": "412fde3a-9467-495c-833c-1173e8205a51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651303723, "uuid": "7de50b0e-1d88-4bfa-a892-12b1d8a67deb", "value": "6144:3EWht3OeTZjCyv2IR2ShquIu1BVV9RtsKjGyauH7VCLOD9nQTK+Rlt3RCcwr:pXTdCyv2+tquI2DVftQyfULCtIvlthC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651303723, "uuid": "fae523c6-112e-4387-a86a-1fc7c29b5fb5", "value": 585216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651303723, "uuid": "90436bdf-f98b-47f5-8771-aea779e3a1e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651303723, "uuid": "ef4e06b8-2b67-43fd-9e88-f4ea29f8caff", "value": "c7f6bc1e4446e8679865321b81398542", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8ae9ee-c870-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651314409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651314409, "uuid": "4e0f1878-485e-4cf8-ac1a-ea83e6405ab1", "comment": "Malware payload (AgentTesla)", "value": "c7d9d795d6cdfa4ad97b4f4d21494440", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651314409, "uuid": "bcd43c5c-fedf-4f40-98a7-c49b537d6a55", "comment": "Malware payload (AgentTesla)", "value": "3443b619eff651cf379c721c3f71f544620e897d151c20fb3247f79f0b8041e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651314409, "uuid": "e34691ba-6e5e-4a55-b1e5-eec68e058b8b", "comment": "Malware payload (AgentTesla)", "value": "53f4c0be30bcd047157a01dd67fc92a7bc57e738", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651314409, "uuid": "4526d0d1-463f-41f8-8fc0-6e02586bd441", "comment": "Malware payload (AgentTesla)", "value": "4cf5342a94f2ca728d3fed3e23f10e8ddccf605fc2fe90d17f95e4cf0c59464ff95e9a48d1b1b909a76282ab058d9432", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651314409, "uuid": "fdc26c5a-e0fa-4d49-b89d-83df34669323", "value": "T172C43305A1523AB21CAEA6E2B9F5A5E7C9F12F3D4B49492F5EFF1251520180FECE04CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651314409, "uuid": "55eb4aa7-b825-4e79-b49a-d0a0b6077623", "value": "12288:83MkFUveg6AdrRTql8eFONFjxutUG8xf4EXg06YBkJO:8crveg6AVlqlJOv+V8hBRYJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651314409, "uuid": "a165971f-8dd8-40f2-a62b-bc6cc14b0d5b", "value": 557420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651314409, "uuid": "3f08720c-8549-44ea-9488-9dd27089cf70", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651314409, "uuid": "93c20785-c006-45ae-b2b1-61d12c08aaca", "value": "new bank details.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c12c413b-c8bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651347356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651347356, "uuid": "95f8ab10-0cc7-48e9-8453-331501a0e867", "comment": "Malware payload (Mirai)", "value": "f417e868c24a80d645253d66046932fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651347356, "uuid": "e6afa38d-52d4-475f-a140-874181b066b8", "comment": "Malware payload (Mirai)", "value": "35372866b0d2c877edf2ef4bd73ee92f822b67bd675bb4c70f3c3a6c4a706f48", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651347356, "uuid": "9365c966-7b2b-47b9-bf0b-f3ffc00596c5", "comment": "Malware payload (Mirai)", "value": "4e6ba0389b2e3121614cf3a10cb80c7df2b4a546", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651347356, "uuid": "9925d2b7-11af-4009-9193-d126e3652982", "comment": "Malware payload (Mirai)", "value": "7988407834acd5a2d9228488a526cc5bc8b41a9abc4292eeaaefd09600f7b24c6a60880621d3660174cb78a683523496", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651347356, "uuid": "e1eda570-c7e4-4ea1-93bc-33c39a00118f", "value": "T1D1D2D129E2951F86FEB799F69A9823C3B7F44F462663CB6052105D79A1332536600EC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651347356, "uuid": "8d462439-8e3a-4444-b4f4-23967fb533d8", "value": "768:URJh8sBh/xg1e4DUsuAiRXnqT3wA24uVcqgw0RKWXn:UZh/xKrpiRXnqrt24u+qgw0UWXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651347356, "uuid": "b492d3e4-ff8c-42ff-94a2-71c1e6767a25", "value": 29628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651347356, "uuid": "4379065e-73a1-4608-a3e7-0e12aa6feec5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651347356, "uuid": "306053c0-383f-4156-943f-19501ea684ac", "value": "f417e868c24a80d645253d66046932fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "845bf72c-c89a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651332651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651332651, "uuid": "e3218c05-62b8-4c9e-89c1-e9c09d74b9b7", "comment": "Malware payload (Mirai)", "value": "5224972c5d3fd95f4d41349683a47370", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651332651, "uuid": "61e922f7-de24-4314-b2c6-6b8b0ac9f836", "comment": "Malware payload (Mirai)", "value": "35eac60a1c6fb2122817e9cca3d45a6cfca79f00121a56a89c2b6e34a8fb5dae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651332651, "uuid": "26bc222c-24cc-4f3f-a2de-30bd1d00ddd2", "comment": "Malware payload (Mirai)", "value": "8750e5c7a155d07cf9465c99d1dc4040f2f3c57e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651332651, "uuid": "745d9d7c-7907-482b-b9ae-8f27c967b673", "comment": "Malware payload (Mirai)", "value": "ec8fdf06d846182c653b56b39ff79f15b63b4ad822d6b92d84ed478803a2542b3f4992fb50299f3beccbe6f3e27981cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651332651, "uuid": "98c8d579-7173-4d68-8dd9-5df2fc8b096a", "value": "T194C2C0B85D0545E2C59D80BDCF961BA06F6A1F82F543E95B3C46DA92DC58AF0B8C3CC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651332651, "uuid": "c3a6baa5-d177-417a-9a82-b5603f4bcee0", "value": "768:RE4SpciEhe/R2mcEzcIzhnhGzU4NPe0JgGlzDpbuR1JV:mlOQcEVzhEFVesVJu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651332651, "uuid": "c98204b6-3c25-47d0-bd61-1bc94b4ca15c", "value": 26432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651332651, "uuid": "b0bbdc7c-61b2-4463-985b-e475a5fb02bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651332651, "uuid": "fcf258cc-11b1-4981-a697-5c636e96d982", "value": "5224972c5d3fd95f4d41349683a47370", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6dd33ac-c8bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651347338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651347338, "uuid": "58db6a7e-ade5-4fcc-97f2-0a94a7ea9c36", "comment": "Malware payload (Mirai)", "value": "c22cbeb5d1894b23fd46e462b1270887", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651347338, "uuid": "256fa43e-16bc-423d-bf63-85d4d26593b2", "comment": "Malware payload (Mirai)", "value": "392a5448fc549cfdaa8e0d614a33b6f5c5947d98737544ff0168639d23b8fef7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651347338, "uuid": "08d5fb4f-b9b9-4be8-836a-64082c95821e", "comment": "Malware payload (Mirai)", "value": "cb2c277c09c1a90db3dd434340e28238a148c9f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651347338, "uuid": "c08c744a-a1da-4ee4-ac71-78e7b3b115d7", "comment": "Malware payload (Mirai)", "value": "cf07025ec37a03783a586d68b526d6be24cc780934d47716d794c8a1cfa8f8a7dd35093f852fa811c63af31fd062de18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651347338, "uuid": "a22a525b-a52b-4a46-bcdc-8e3955df515b", "value": "T173E2E09EB4F8BDC1C95DE9FDC18703A2D686A4817A0FDA4DD300BA4926308177D5D8F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651347338, "uuid": "40ad6cc6-b77e-4216-9c89-f9269cb94921", "value": "384:NxEY+tVWAT/bKqbnpFr+bbOS9i693xgKn2bDBwvXuZFE6cS9xzDxvikHI429dRWH:UPLLb3npg5VJ2KnsPH9x3xvc4urWMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651347338, "uuid": "0389534b-abd5-4929-bacf-364cf881c64d", "value": 33456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651347338, "uuid": "2c928a50-0eae-477b-9fa4-d0b272cf281e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651347338, "uuid": "d2677207-5914-4e52-a76c-c38b3bc72208", "value": "c22cbeb5d1894b23fd46e462b1270887", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39de92fd-c84c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651299025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651299025, "uuid": "b4a2a282-970b-449c-b4a1-1cf37d86405b", "comment": "Malware payload (Formbook)", "value": "5b75d657afe1209016aa11ab952519ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651299025, "uuid": "8607867e-b7e9-4e68-8e3a-4c6bd6314d05", "comment": "Malware payload (Formbook)", "value": "394c2420ddab4655b1045c1decd4a5004f2686659ac584223fd45767fee04db4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651299025, "uuid": "20e709c3-25b7-4801-81ef-b2514c354004", "comment": "Malware payload (Formbook)", "value": "97282f0c68b1cc926d649d8bf44308bdeab231b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651299025, "uuid": "b843fdfa-3ed4-404a-a58d-82c013fb3483", "comment": "Malware payload (Formbook)", "value": "0b2012a9874058db1db92c9a2264f1181d6ab0ec98c0c26855374ff120f1124f6020479a99a37579d84013e74cccacbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651299025, "uuid": "a8b043d6-74ef-4148-bac5-9591277598b7", "value": "T18514021536A4C0A7D5A31F311F390B6697FE6A1701A8470B33B0670CB7A37629E8E757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651299025, "uuid": "1c03c048-bff0-4227-a687-ae542db4226f", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651299025, "uuid": "6dbd9c9c-35af-45bb-8577-b5f86034d242", "value": "3072:l1NjcVVnLpPunbk7cb/KxVpIASQ6SEkknHNUkQWQyQxCZ1R8WPFTdUjf:HNeZmkYLKxVpITQNlaQWRi3eUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651299025, "uuid": "bb627a59-0bd9-4118-8bca-90b75d0ee515", "value": 197199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651299025, "uuid": "4ab5fa0b-fcf1-46ee-bd2b-f289c63aee37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651299025, "uuid": "aa4c85b6-b780-4129-8aa6-91939af631fa", "value": "PI160256.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce83c17-c873-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651315807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651315807, "uuid": "af2b83f5-0d86-44f4-8a40-00a724818600", "comment": "Malware payload (Mirai)", "value": "c93579fc3af7a9356372d4bcc4934b88", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651315807, "uuid": "8efae6b2-f8ee-441b-a722-dc19a3c637a5", "comment": "Malware payload (Mirai)", "value": "3a5e69e8eacfc8d582dbdb4a30bc26fba50aeb8a2edbaf091f321625b5055cc5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651315807, "uuid": "56e6adae-3e30-490e-8bc8-b72a35c67f4f", "comment": "Malware payload (Mirai)", "value": "c7849c9887b211c041805c81c3abc20eb23aae8e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651315807, "uuid": "30be83ca-7e79-4a9b-8681-e11b481dc303", "comment": "Malware payload (Mirai)", "value": "263284e60a93d2e44c309cb728806bb77f22c5c2ecf8692ddce00e355e398aac6d20759584c903efeca69db13fd85107", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651315807, "uuid": "1ff170d8-678d-4a88-b4f8-c6787d1afca0", "value": "T169B2E12466777D00D17207356922C6CF59305ABCB1E3FDE225644AFC6AC72A26B3D487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651315807, "uuid": "1e6a2e95-5145-437e-bf4b-cf65e9c1a109", "value": "384:c0jz+VLREhwyFJQ57Tg2R0Lxz/CGzXNglHViubmwnTlhymdGUop5hVD:cxlEhwy85/pkxzDyV9mwnTls3UozPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651315807, "uuid": "19ed9441-8ba4-4755-9697-88f2218b1e3b", "value": 24656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651315807, "uuid": "12f829ca-09d7-450c-be65-fd80f8644485", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651315807, "uuid": "6031c617-e389-4a0c-a31c-9b1a53d5af8e", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f90dcf0-c8ad-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651340749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651340749, "uuid": "0e0e1b95-b9d7-4a2e-bc02-23efd3f5b376", "comment": "Malware payload", "value": "924440e04ebddd4c8b9982aa7ca0f8e4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651340749, "uuid": "33c1f660-5fc4-402a-ae2d-a4738d520609", "comment": "Malware payload", "value": "3a9b7a662ae9afbfc9238b36016b649644734b832c58257817d94c31cd981e0b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651340749, "uuid": "c3fd46d6-9395-4db4-8705-44b033423aee", "comment": "Malware payload", "value": "0bd53576136c391569dcc971f84541bf39bf29d6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651340749, "uuid": "1f94020f-b4a1-4781-8e16-487ca1f68102", "comment": "Malware payload", "value": "5bf4c7dcc93f0d0c5495eb891719a5f6e3876fd949ad1d4c041ab16517dc478a291e6fd92646530065c53256cbd86622", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651340749, "uuid": "cb3d5b51-352b-45fd-8b03-b81a35b2d425", "value": "T10094CF21B68CC87AC27732398453477157F9BC204B75EBAB2BA04B795F73781893874A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651340749, "uuid": "11f16a5f-e518-467d-8995-863dbbf82b03", "value": "7a8eae48cbeb9b498cff13262d717430", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651340749, "uuid": "08c0e9da-a64d-4774-8d11-27c005cecc3b", "value": "6144:3qubfjnyfAdoAuYqMPkbeKdkeZ7fOauSU4Ko2qYyw3MUR6ytq:auXynYqMPk6KBslPyw3MUxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651340749, "uuid": "95c04902-a3ef-4c9d-a3a1-a7d819c98852", "value": 441344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651340749, "uuid": "dd6e72d4-6ec5-48ea-8893-21f09ba448d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651340749, "uuid": "099fb200-ab87-4076-9f4d-d0ef211de386", "value": "emotet_exe_e4_e61db085d5861fc0248237cee13101927b9949f2094d1b2961e46f582b80b88d_2022-04-30__174544.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f661258-c88c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651326603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651326603, "uuid": "53784a20-492b-4f5a-bb0f-3f2900608c16", "comment": "Malware payload (Mirai)", "value": "e481baac9a14a6210dea30f8d4ec2be3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651326603, "uuid": "a379cf03-12fd-4f86-bfa8-b7b18cf046d6", "comment": "Malware payload (Mirai)", "value": "3c84ccd3dac05674c3b18adbec62a438eb968b900a61b849439c7e922a7d4de3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651326603, "uuid": "cf2d0ccc-d9c7-4cfa-8407-83e286ff487b", "comment": "Malware payload (Mirai)", "value": "99d9b7fed0ef1fb5b3837a49f824303f867d1855", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651326603, "uuid": "718806a2-7abb-42b5-9a65-5b52fbd36ae5", "comment": "Malware payload (Mirai)", "value": "7148497f73d24804a9dd929f549902136acf98a08e67c2cb5603a8334be2dd5c816714119d7585e637cca5250acb3e42", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651326603, "uuid": "230a4d56-3ced-4d8c-b3a2-47330a622d8e", "value": "T1F433E606EF900EABDC6FDE3302B9075135CD954722A8377A3534D938F66A54B4AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651326603, "uuid": "a86484c5-e67a-4c6e-a0ae-9877b8e79d38", "value": "768:bZh760e+reimklzww4xRkZ8tsXi0Mes0QvX2sy9hblyXpaII:bZhW0XrlcPaZ8tNTvGsy9v4pa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651326603, "uuid": "fdea81a6-2475-4503-ac13-8e2c184ae522", "value": 51760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651326603, "uuid": "9345555e-2545-4090-bad4-235e9cd95ca3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651326603, "uuid": "87df27d7-22dc-48a9-9700-fe3da5758b41", "value": "beamer.mpsl-20220430-1350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae49659-c894-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1651330246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651330246, "uuid": "829037f3-9112-4bb9-98e8-abc8799923c7", "comment": "Malware payload (AsyncRAT)", "value": "b6dbbded2ca82116c6da9bae34cfa6e9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651330246, "uuid": "0a1d9f61-ba65-419f-be12-889e56b10ce2", "comment": "Malware payload (AsyncRAT)", "value": "3c9960dabfdfbe9b14a8405d8a8f48c6f4bf976925cfa7660cca0056e1b17d45", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651330246, "uuid": "8df7f0df-e66d-4c9a-9b3f-6ee145f77f5f", "comment": "Malware payload (AsyncRAT)", "value": "3d1b8ad9b59b926a49110bff0e6d4b5bdc4e0145", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651330246, "uuid": "8c88f903-e278-4992-b57f-437e360f5240", "comment": "Malware payload (AsyncRAT)", "value": "b74a904f59182148b9deca4127c1c9c6d9b8fc7860be433d82f066330a08b327f5a0d43e160a727d7c64217e47b0ec2e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651330246, "uuid": "f06fee52-327a-4329-af34-5086c29b9940", "value": "T11D235C403BA8C136E2BD4BB4ADF391458676D36B1903C65D6CC824EA2F13BC596136FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651330246, "uuid": "6e3209f8-112f-4e8a-a856-664a9e8327fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651330246, "uuid": "03dc2e94-fcc2-4d1b-8361-767c2b603932", "value": "768:FOEuILWCKi+DirOYUis98YbBge7/s3cKvEgK/JPZVc6KN:FOtmrOvzbu7nkJPZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651330246, "uuid": "85018c58-4876-4fae-81d8-48cdbbc70220", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651330246, "uuid": "465355d5-26b2-4aae-907d-6c68d05a94ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651330246, "uuid": "dc49384b-a518-4b3f-a07d-a8a9a401509f", "value": "b6dbbded2ca82116c6da9bae34cfa6e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5020344-c845-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651296306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651296306, "uuid": "2a45903e-b8b1-4f14-8a6b-362aecebf372", "comment": "Malware payload (Heodo)", "value": "9275bcba102c124a7356f6b89bca62df", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651296306, "uuid": "766ac886-5342-4438-b15c-63710cadf5bc", "comment": "Malware payload (Heodo)", "value": "3fc33b21ed7c112ca1e6e0c18424bd66cec7b7a51e936cf8620bee8d7203c14b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651296306, "uuid": "c9161b1e-63d3-4601-89df-fa31ff12604a", "comment": "Malware payload (Heodo)", "value": "829becb6b3a3a2dcce464fb8d2cf6435053a155f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651296306, "uuid": "0fe01512-8886-45a9-ac32-762f9b9021a1", "comment": "Malware payload (Heodo)", "value": "cfb1ccd724cf915c80161c58b5de9bc03d666594fdbb50ea54e60725dd106e1b619bea9a130b29561b5252ab8643ace3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651296306, "uuid": "d2da1cb0-7593-407d-a9ed-35f8cb163183", "value": "T109E4CE41B2D9C076D16A1A39A57367A15A7DFC52EE38C24BB350BECEBD312408D7432B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651296306, "uuid": "45009669-1771-4fe1-8bf5-3b77b1c5ee0f", "value": "c0eaca862e71892f0b09074d92f8955f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651296306, "uuid": "206d019f-fc08-4b1b-a763-f882be2aea44", "value": "6144:3QfYaJlKdMDan9+2VhqOWOLt5ZZnB9iHC4CqhAMQvYqq/9CwU4veymj9LQBiRXZ7:3Qw+CM2n9+6qsRlSLhIe9hijX3rUXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651296306, "uuid": "cf774645-bc8a-45df-9a02-42a2e49e4b7a", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651296306, "uuid": "1bed13f4-3d51-41e7-accd-ff5fed4782cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651296306, "uuid": "8260b5a8-10e5-4c37-96d3-a0d65ba4f2d9", "value": "emotet_exe_e4_bdb91703d1cf9b8c54031ae98fa85680b3a0c1c6daa6de4fea1d252458d768b3_2022-04-30__052501.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd76e98b-c864-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651309607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651309607, "uuid": "7932de9f-5b78-460b-ba84-301d7d4e28dd", "comment": "Malware payload (Mirai)", "value": "12e2e0f380d56918b6f302c4eac29ba5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651309607, "uuid": "33820757-5fa2-4183-a026-2965e122a869", "comment": "Malware payload (Mirai)", "value": "411647e8eedd3b01a87c773339612f0aae650efc7a452176519c537f909a0df1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651309607, "uuid": "f3919cf7-32f2-4016-8006-6b7d5dd9873f", "comment": "Malware payload (Mirai)", "value": "bff99cc741b22d48672a72442a165dce88602ff0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651309607, "uuid": "4953bd60-5257-4910-9a56-bac7d54be422", "comment": "Malware payload (Mirai)", "value": "e41cd3ed188734a2952abd9511dcbecf0c5acc8dfc3ba7d4c2e65d47d6e28e60bb3b76464ac9b9849ce0bc4b1fd7ccfa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651309607, "uuid": "7c565ceb-b861-41d4-ad50-f422075998b7", "value": "T171735DD5E8029E7CF55B9ABD81134A09AC21A3054BD30F2BE7A7FCD37CF21989A46D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651309607, "uuid": "66123a37-f2da-47dd-a685-56bc36963fda", "value": "1536:kdnxbaw88iPF5qgXaiAvwDuz0msHrbLa1B80uCL:WqFkoAvwyYZLEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651309607, "uuid": "55fc83bf-1ee1-490f-877b-acc37d0ce564", "value": 79256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651309607, "uuid": "9f52a913-9c35-4ee1-9b83-7655ee62df8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651309607, "uuid": "58e0c1d8-361e-4341-9562-6ed521da2a98", "value": "12e2e0f380d56918b6f302c4eac29ba5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d1e71bf-c81d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651279005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651279005, "uuid": "e8df3437-f732-45a0-841e-1b741dc36a06", "comment": "Malware payload (Heodo)", "value": "ed545970bc2c20d0961fc70c588cb6fb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651279005, "uuid": "373900cb-9e69-480c-8e31-abf14fcf39b8", "comment": "Malware payload (Heodo)", "value": "4282277b7ed3167d6c4e4a74fb3acd48971d436708860ff1b733609d28efbe43", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651279005, "uuid": "28a17d6c-75ce-41ba-a0e4-aecf654a1489", "comment": "Malware payload (Heodo)", "value": "88208951e5fb070a8ddcba3f96f61d51018a70c7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651279005, "uuid": "26bee6c0-b74b-4148-827b-3d32882cfef7", "comment": "Malware payload (Heodo)", "value": "03f96034cd1ccde642479e18778b903c2b8be8e35318fde6883530acf7ae132d5a80b6344de908b63d1d9728be3cb438", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651279005, "uuid": "2b1ca74b-f4d2-48a6-89a3-be2b3d1934cb", "value": "T1C4C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651279005, "uuid": "93dcef77-9c48-4479-9334-ee4f5c792038", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651279005, "uuid": "49094f15-f1ed-4c61-b38c-094d7d55ff39", "value": "6144:JhZ02GdOOgPY6KUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFf5KRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651279005, "uuid": "1337071d-c06e-41d9-9ccc-8b9e9d84283a", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651279005, "uuid": "17e5e27d-bb33-4abb-a74b-c9a8410af940", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651279005, "uuid": "78bec2a5-ad51-4b19-93d2-86d56564539c", "value": "ed545970bc2c20d0961fc70c588cb6fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e6d3cf-c836-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651289843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289843, "uuid": "625df3af-8feb-408a-9c8c-392fd3b421e4", "comment": "Malware payload (Mirai)", "value": "0257a10e26c6e83fb2095d324bd0e134", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289843, "uuid": "35c3f66f-9154-4d56-a060-d9d8a51b1b40", "comment": "Malware payload (Mirai)", "value": "42ae84d0b3cde1663d601515d09d0ae24bad8e8de5351032d3f66261b053377f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289843, "uuid": "8df260b6-559b-4a7a-aecc-ee1ac2c4e44b", "comment": "Malware payload (Mirai)", "value": "98dae63a15b7c543979e7731c54c77a09301e389", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289843, "uuid": "53f409cd-ea18-402d-bbfa-40f68c2a1b6d", "comment": "Malware payload (Mirai)", "value": "9f1fa04baff717a85b33d284ea826e3d0bfd67adf8b5fc35cbdb0d609d0489f5f6aea7f547d36e66a65ce69874e0bf26", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289843, "uuid": "46786741-5c4b-4f39-9140-d92ca948ae44", "value": "T165D2E0B0954676F2D2306439EBD89E9757C21370F1FF76E3172820A539E20CAB27119B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289843, "uuid": "b25323db-d6cc-4466-8771-82bb99a3ac17", "value": "384:U+pBNm5t8706u9jtiyM0hYQEmIydiLynH0gkPZS6sDGFXYuyKVCiRwpcf+hymdGf:zA4uBc0T54cH0jZJ7l3XVjwts3UozV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651289843, "uuid": "31fbb946-48a2-45fe-a236-33d7b27d1406", "value": 29952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651289843, "uuid": "b25d83fe-5acd-406c-8d59-7627465ae4a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289843, "uuid": "8fd9a5fd-dc77-4737-97e6-e6788b536ec2", "value": "0257a10e26c6e83fb2095d324bd0e134", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6284ebf-c82f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651286859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286859, "uuid": "07ecb433-3b64-4897-8770-1a6f731285ae", "comment": "Malware payload (Mirai)", "value": "89d9b06b0f5e452ad9338f666cffe2fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286859, "uuid": "1a531769-4a65-4a33-81a4-62f71e7af255", "comment": "Malware payload (Mirai)", "value": "4370df2606d22fa6c0a0a582420e9e2b71d61acc272304c624bb19a76f0ecce1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286859, "uuid": "bc36db1b-655b-4e10-8237-7fa86ff4a11f", "comment": "Malware payload (Mirai)", "value": "7079d19a67092c8abae7f6ef80fbbc602cc50bb1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286859, "uuid": "c1a7e6a5-24f0-41fb-b516-bf3e8137f071", "comment": "Malware payload (Mirai)", "value": "1acd7a033d1aaaa83648327972ba56d891fd3971a4ec87cc84b270df6c1154e0d3f65b02b7c9c0a1ef3e070194c3b068", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651286859, "uuid": "ddc54f08-aa77-4f8d-863c-4dc85e45e929", "value": "T1E483A40ABFA15EF7ECABEC3749AA1B4524CD541721983B75BD34D818F64A20F05E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651286859, "uuid": "2e7d1ac6-2638-41c9-b9d9-752842ade3d6", "value": "1536:hk51WaBO2hq+Vpwj30jqtEY6NpabHPGtVCmOpBsekLrrc:hI1WaBJhtVpI0uWIgO0rrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651286859, "uuid": "02e3d582-ef21-4ddc-abcf-4ee502c0519c", "value": 88376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651286859, "uuid": "361c3c22-601d-4578-929d-145a2da3773f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651286859, "uuid": "df4a2e4f-fe42-41d6-9285-79f614929be6", "value": "89d9b06b0f5e452ad9338f666cffe2fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf977757-c852-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651301826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301826, "uuid": "1b934550-758f-4173-85d9-f8640345f227", "comment": "Malware payload (Formbook)", "value": "852d6f0ccf45f6ca87e2b9587cb8ee66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301826, "uuid": "22234647-6105-4926-a4ee-c27f100c0f86", "comment": "Malware payload (Formbook)", "value": "449d654ed9808527ade5738c5a4b5891daff8283243f0738edf83a10570f910a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301826, "uuid": "b7e4b6ff-6c80-4a03-9bca-61b69f5271d2", "comment": "Malware payload (Formbook)", "value": "8aad0045a38d027ce13e29b43b44208abf99d64e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301826, "uuid": "fe595a58-f7a7-4c72-a503-a7ada1b8297e", "comment": "Malware payload (Formbook)", "value": "a195a8c7b1efabc29d6dc5a64f601ed82dad4ca869fe093318f37914640ba47fc6945b7776ac76d3d32784b529798dd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301826, "uuid": "f4d11b2d-5e27-488a-bf89-9b5f81f17dd8", "value": "T184D4AD076E5CB2D6FA6D07B90826E27477A4ED992D20EE4A29F07EDBF530705C500A37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301826, "uuid": "5ac2a270-7675-41de-b1ec-7c57c93b99cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301826, "uuid": "58e7ac95-86ea-4664-9cc5-e9c21fc81c00", "value": "12288:CCYNLvPGg/AwXnPqgwkJ+rq7ZqC/IKHBelzCIBOAcCrFGqQ:+LvPGuAwXAkP7ZxrMlzRsAcKFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651301826, "uuid": "e203a905-1d2f-4b39-8162-0b68a1897ae3", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651301826, "uuid": "3abed014-c000-4764-b51c-1637ecdef662", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301826, "uuid": "92450f10-a8ed-4572-8912-d28bffa83785", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6067c17b-c89f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651334738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651334738, "uuid": "0106c5b3-d0bb-4a28-9d42-325d16addd03", "comment": "Malware payload (Mirai)", "value": "e08e034049f9e9d3b5dc50b3cc314e29", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651334738, "uuid": "bbc5dc0c-3a42-4ed9-b40e-84e2189ddfc2", "comment": "Malware payload (Mirai)", "value": "45d5257797e12a37b4709fa7c027f8c14cbe5f67fbcff0013a5e5ea3d0d2b684", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651334738, "uuid": "db8c4f04-5e11-4209-ac35-8412ed726d2c", "comment": "Malware payload (Mirai)", "value": "86499343e9c39cf84700c364d4c974ebd40d8d5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651334738, "uuid": "bd94f350-31da-408c-9a64-bf4f80c6bd84", "comment": "Malware payload (Mirai)", "value": "f11e134128c158536a2a245cac0c32ff6a1ae0c1be1b7f9e75dbddb63a5ae411f25ab11ee39cb7fd18741991060edc49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651334738, "uuid": "1bca4f98-4d8c-4fa8-bc52-3b8b771d34ca", "value": "T1F213E18A955559D3CDFF5CF44FC0E64CAB801E0B22A8CC29584C2A0139F88D9DB1DEEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651334738, "uuid": "e85da73e-f961-4b13-938e-638801fc80be", "value": "768:7RIqATqE6NHPHMXmOJ8YATyiyZQVeHivzkyzdR0Iq4uVcqgw0zwkfHxzhR75jMa:9IJTqhLTyiWKIOkyzdR0p4u+qgw0zw0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651334738, "uuid": "103a1e92-d6f5-4e71-9966-4716bfc543b1", "value": 44964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651334738, "uuid": "a58d0392-0769-4805-9d61-20c92be04de7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651334738, "uuid": "aeac93bf-65ed-4398-a95e-7f425cb4cb7e", "value": "e08e034049f9e9d3b5dc50b3cc314e29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66395562-c853-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gozi)", "timestamp": 1651302106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302106, "uuid": "352ad91d-70b5-4b08-9584-04826bcd98d6", "comment": "Malware payload (Gozi)", "value": "b3916883ed8017a17626bab708fcb1e8", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302106, "uuid": "6b56e95c-166b-441f-a276-b5ce3b36b380", "comment": "Malware payload (Gozi)", "value": "46430bbb1d9b0711f1013f570898e873c34a1d3cd486b80b3f5f2af9cf9c896c", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302106, "uuid": "0bf130a9-97fd-4e96-931e-0ff11f32bf88", "comment": "Malware payload (Gozi)", "value": "c417745a07d3895c9cc55c687b3f2ca77d5b36fc", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302106, "uuid": "04c88fcb-8036-47e0-ae8d-512582d83ed8", "comment": "Malware payload (Gozi)", "value": "5bad0c40e29b068256babef61329f489ce25a14abacc79602482b1c9728eafcd32bbc15c2505527836f5585b5f298cff", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651302106, "uuid": "97361d94-b287-493d-933c-6cad6f869d61", "value": "T1DD8127A8074FCAF8A613AC88C1D94A57EFA592264A3CE6C4CF70BEFB100457CD4F5498", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651302106, "uuid": "79a38326-1b72-44d5-b968-e99cd8efb5fc", "value": "96:OiQefJqLGWCnASnHLE4vnF3O7T+yR3dz6UuDC2DpFG0AUL:OlefsiW4LHwmnF3G+yR3J6TW2tFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651302106, "uuid": "2bb0518d-1634-41a0-9d08-f1f7e9672e9f", "value": 4006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651302106, "uuid": "1fedde0d-1c61-4d4f-bce6-b43c963fdb56", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651302106, "uuid": "1d28e76c-feb2-4703-8e26-bca926adb44d", "value": "documentaz_661.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b4c4c2c-c868-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651311188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311188, "uuid": "4fe783aa-80c0-46c2-8119-6518e8f82e63", "comment": "Malware payload (AgentTesla)", "value": "6adf4f205e159260ba2b6d0c1ae1edaf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311188, "uuid": "f3def572-799f-4abd-bc4a-a8615521d24a", "comment": "Malware payload (AgentTesla)", "value": "4768782634dee0c91f20d2a9216c52ac076a22d7a02f3401e7e924f3ac620caf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311188, "uuid": "912832e1-914c-49ec-afff-f55232c7675c", "comment": "Malware payload (AgentTesla)", "value": "c1165907fa1363f693c26c0ba1863d6b86d01692", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311188, "uuid": "a39577c5-ad97-4142-93f0-56558f07bf77", "comment": "Malware payload (AgentTesla)", "value": "29680f260588c53b42617cc4c6d4f176de5bdea82ffa270ce48ab6fbf488346875e229d22ccdbef61bbf8b1e81d1f907", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651311188, "uuid": "75f80ffd-eebb-4dff-9e35-4d1e34fc4608", "value": "T18FA423DDAB32521BB55B06CC9E75D091CBA4DFBBC3C480A6BC70A69074D8E690CC85DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651311188, "uuid": "64b23459-70a2-4a08-98da-70f681305438", "value": "12288:uBtp8YVhDTxtb+uK/pPm/9DqfDtELqhm1CgWe0fQaNBturQ:uBtpzVFTPCJm/9DqfGLqhmYdPN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651311188, "uuid": "a4b968d4-1464-4964-9943-98cf8ac0d24d", "value": 461369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651311188, "uuid": "66e8768b-a7c1-47a7-a91f-9a77fde5b158", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651311188, "uuid": "9503dd10-c1e8-4d6d-8d48-4c5cf8a0acda", "value": "Request Quotation.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc51e2b-c8c0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651348957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651348957, "uuid": "ba948c10-7b7a-443e-a371-f1a4a0c5fb7f", "comment": "Malware payload", "value": "d769071d0df860a6b47c64c714fe157f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651348957, "uuid": "c080f6a3-f89c-4a7e-8623-5daeca1abfb6", "comment": "Malware payload", "value": "47ddef1c4f86dfb764d6d1ac54d5e1e65116849a2921420db24a45bdaa65f81b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651348957, "uuid": "328d5e9a-a3d1-4da8-8334-29bc00ecceff", "comment": "Malware payload", "value": "4d5f2d4b614ce82626d22045096ae737a4040ff1", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651348957, "uuid": "54c88288-42f2-4935-b2f3-18125013b810", "comment": "Malware payload", "value": "7db544ba64351ffb71dce894e2216b421e6d9c9efeb57b8c0decc861f370fedce6fb296ed7d3a7fc048cf75808413417", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651348957, "uuid": "9bcaa750-a65f-4d96-ae17-2e8906764850", "value": "T10F623B1E1DFCF80EE75F0C3B635051869A45E158FE74D72B119D22A06CD4BAB1B12B4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651348957, "uuid": "25136d67-4fc3-4c64-bf69-dc2d93a2bef1", "value": "192:ri17lje0Q9cQ9nOMhxo3JzxihAZxWJUYd6b2nK9aWBGFr8Ey2pkufRzo98tCHepY:ra5c9dlhS3JM6qJUYznKbEy2XjlW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651348957, "uuid": "77b2577b-5b5e-403e-8ecd-07fd0e0c2c83", "value": 15721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651348957, "uuid": "a0fdf530-eba6-4ddf-b228-c1e64bb9ba6b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651348957, "uuid": "9194b056-6c74-46a2-9b37-b4937db46181", "value": "Pizza_Client-1.1.3.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e687951b-c829-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651284282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651284282, "uuid": "40ced6b7-d9b8-40eb-95d4-5c014f941644", "comment": "Malware payload (Heodo)", "value": "a9720afc33c72654029ff2660aa83ddd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651284282, "uuid": "4d38b4fa-763f-4351-acdf-4d3ec00f41f7", "comment": "Malware payload (Heodo)", "value": "47e7ea587c02a4b1e1a90448aa2ec7d26b1bcbde792d304ac29431a347c4f27c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651284282, "uuid": "1626e37f-5d51-41c1-bbf3-912d957b9ecf", "comment": "Malware payload (Heodo)", "value": "aee8c6aeecf46fd91b1e14bb60064f9c716a8a96", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651284282, "uuid": "f6770b10-755f-4575-a681-8edf6d867d7f", "comment": "Malware payload (Heodo)", "value": "7c6356df7c9e9da3a56aceed4f9b00f976a1e07c44341fd731a08b3a67aac1360b57db1015cf87b2151f28294954e87a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651284282, "uuid": "de19342b-8653-4193-8096-af7981b70711", "value": "T114C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651284282, "uuid": "a4b36466-fb16-4856-bbce-bbc5cc1645c5", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651284282, "uuid": "a12140b6-7fec-42c4-80fb-a24b1e41f409", "value": "6144:JhZ02GdOOgPYkKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFf7KRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651284282, "uuid": "2e0c3580-26c3-4b9a-a6e9-0816e120818a", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651284282, "uuid": "58e6216a-4e51-4db9-8fcd-731d7b5ab2e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651284282, "uuid": "251c8e72-3d44-44c0-a066-c43fc5ac94f9", "value": "a9720afc33c72654029ff2660aa83ddd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f31d3b-c81d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651279017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651279017, "uuid": "6c513638-d138-476f-bbe0-9ba919b78c54", "comment": "Malware payload (Heodo)", "value": "14fb9acc3860abbe996ab8d403e7b65c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651279017, "uuid": "8973b6c9-d926-4cd1-a238-99a6f3da9350", "comment": "Malware payload (Heodo)", "value": "4948df97735df850bab7fa89ae44d0ad1b3519dd337481ec737247e744304312", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651279017, "uuid": "413145e2-40b7-4649-ab63-a16396584704", "comment": "Malware payload (Heodo)", "value": "3e726c413c320c3b41356b87dc35ac79688f306a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651279017, "uuid": "be5ea25a-cb91-45a9-a014-5731d63b2058", "comment": "Malware payload (Heodo)", "value": "22fab0ad9a331654e67988b9bfa1ce7d5cc71e84daff157d95d2e4a31e2a7694e00c2eec11b50b801d34ba21cab66d00", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651279017, "uuid": "3e64fe04-1ed8-4305-bf75-ec7ce4fc2579", "value": "T15DC4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651279017, "uuid": "34eb9d32-3ea6-43dc-8b5f-d70650aaa58c", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651279017, "uuid": "cb47046c-05f9-4751-9520-2cae87fcdb16", "value": "6144:JhZ02GdOOgPY+KUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfhKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651279017, "uuid": "c2edf89a-1e3f-4af4-9aad-6c88909b3455", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651279017, "uuid": "c98b0b67-ca3d-41de-be92-010a7a53cfa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651279017, "uuid": "5ff38b16-dab6-4c82-9ac4-93ac253a6f01", "value": "14fb9acc3860abbe996ab8d403e7b65c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ec3999-c8b6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651344617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651344617, "uuid": "6542f850-f735-4a5e-a540-9c230680d35f", "comment": "Malware payload (Mirai)", "value": "4cbbae0e526101be2a0e3b32149d2f57", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651344617, "uuid": "e3831311-b5b1-4539-96ec-e99dfec057f9", "comment": "Malware payload (Mirai)", "value": "4a48811c2715ad393714ae2a78d759f9c483b89c7b5404984e7b08a273ef7c11", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651344617, "uuid": "9e44e8bd-3f7f-4f7d-971d-aa9bf307bc6d", "comment": "Malware payload (Mirai)", "value": "b0d04e1a61d8314dfb51477e28d45548961250ac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651344617, "uuid": "46806fc9-6572-4782-9127-9014b3b89e4d", "comment": "Malware payload (Mirai)", "value": "9aa7008aaf7420eb765bc0f109e65b675c26b54813be25c116970f62cf8ad91a179d54a409b8c003b08b1953a3517969", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651344617, "uuid": "0f2cdf72-077e-4cc5-95db-9cf393dd6f3f", "value": "T12F33F1B918CA9E32E111693BA0720257BB9E0FE5C7FF70A2494CD6279B943C736F4505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651344617, "uuid": "87dc5285-6b55-4001-b962-a0de55c83ec6", "value": "1536:h/pCYf0kacuhqi/pa8M/67Ql3sdlsuskcyU99gHxir4ZP:hQeacuhqigVu8kU9Swu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651344617, "uuid": "6473293a-6020-4eb2-88ab-38bcceec9c55", "value": 54984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651344617, "uuid": "37b06714-76e4-47c3-893c-88a02eec504e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651344617, "uuid": "9f9f6d2b-0add-49c4-840d-22c73f0dc9ab", "value": "apep.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3cfc3d2-c8a0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651335281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651335281, "uuid": "e2d28cb4-ca8c-4f0e-b1eb-3dadd2fa9556", "comment": "Malware payload (Mirai)", "value": "6927ee014df10e19e6d4bf3cca20dedd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651335281, "uuid": "11ce028c-6faa-4294-aaa9-1bba8b68a2c4", "comment": "Malware payload (Mirai)", "value": "4c3eca6127ca8dce993234421f865696300cc43a575349ef082a340269dcab1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651335281, "uuid": "7907c0b5-c505-47b9-ad58-e558c9c428e1", "comment": "Malware payload (Mirai)", "value": "b15876e6edba2a8d3ea85f70f1d05a88c4dada29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651335281, "uuid": "eeeb3ed6-069d-4c95-9209-8f9c8f687d20", "comment": "Malware payload (Mirai)", "value": "af4c208bf020d16f83b029770cb402a67101055fc6ab3b6a2c14d4ac9144f04be1d4ffea5ed69cbfe4da46dd537e3cf5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651335281, "uuid": "b90107d5-f7ac-4a1d-812c-cfdd3c37b037", "value": "T1D1531925BD751A26C0D4A17A21FB8705FAF6138E22B4861E3DB20E9EFF507406513BF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651335281, "uuid": "4e7a5718-9a05-44d5-af8a-9c64a8bb7914", "value": "768:1Rotfc3BbKf35UIm4N6xN+406Wsh5ir1dnQdENSvIwBO+2x741lM:1RmfcRbKf35Ut3xNq6vhYRSxyqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651335281, "uuid": "31c77441-0eb0-468b-9d32-3ab2f10b94cf", "value": 61200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651335281, "uuid": "b6b68f83-cf77-4fa2-8473-2bb4da07da0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651335281, "uuid": "bb3571c5-edc7-41bd-b2d2-3f2f6b74cf25", "value": "6927ee014df10e19e6d4bf3cca20dedd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c89966-c834-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651288922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651288922, "uuid": "6e65cc8f-6c50-4148-938e-f13e5aa9c8f3", "comment": "Malware payload (Heodo)", "value": "f148314464d5e01eea76f8f864a87f52", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651288922, "uuid": "5b62fabc-49cd-4ed7-bb7d-7988aaa2516a", "comment": "Malware payload (Heodo)", "value": "4e1baffe4077e80646285ba6d797ae304ea2fe089528c618985d39637dc8fe43", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651288922, "uuid": "b22db057-247e-47ea-8779-d2caf75da9a1", "comment": "Malware payload (Heodo)", "value": "095c7566083759b7969b197a429a959ff816e65c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651288922, "uuid": "631a3022-00f5-4591-9df0-0c0a0cb4a32e", "comment": "Malware payload (Heodo)", "value": "32ca28f180b30aa90a3df83dec09d90f6c68c40a6e2cb0b453e9754b52aa91db8d85ad52500968c05a3ce3ca689168f2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651288922, "uuid": "53733c28-3dd6-410f-9245-e3e9101c8e22", "value": "T1D505BF03B6D94FB6E927973544F6D3311336FD9023278B1F5A50AA3A0E37E906F84692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651288922, "uuid": "72429eff-92e1-4d95-9255-3515eff1c0b5", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651288922, "uuid": "769322a4-ba4e-40e4-a93c-cd88f60a71ae", "value": "12288:JhFf2KRM4c6CeOFzLcQUZvqXmI4Fog8PokRssNzhTgnJo:Jhx3k6CpF34vqXmI4FoggoSNhTgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651288922, "uuid": "f00dfd7a-4dc1-4517-a5f0-d831ba48ba0b", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651288922, "uuid": "712ffd05-7cbf-4ad0-9982-40aca55bf759", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651288922, "uuid": "3d3a70dd-8bc9-4b0e-b289-cb421e77b711", "value": "emotet_exe_e4_c458692027521a099faee176b75d005acc8832c3185a54bfe82b4594d016f80d_2022-04-30__032156.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87727e3a-c862-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651308604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308604, "uuid": "e8e7993c-1446-491d-84d3-2b3a0409ebb4", "comment": "Malware payload (Mirai)", "value": "ac5cb1a247dd3444076ba4ff1715790a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308604, "uuid": "300223f3-a192-4014-8f0b-cbc3ff831ed4", "comment": "Malware payload (Mirai)", "value": "4fe75a2f203faa8a1cdf05be8285588952316980255f189ca2e03706d16835ae", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308604, "uuid": "f96108de-28a0-4752-ad44-4fef2c1e7ff2", "comment": "Malware payload (Mirai)", "value": "05e5daa65ac9d11f04d2ee2e4ad5c42f0d7d1f4c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308604, "uuid": "78fcc38c-c862-48a7-9c3a-0ddf08a3c9d3", "comment": "Malware payload (Mirai)", "value": "ea1b5d9bbe8bbbd200dad50236ffe0fa9d1aaa4c35876dfeaa29b5f3d6b648c4987fa2468b242eff4c768d7a8f2f21f9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308604, "uuid": "7133ef8a-2828-499e-8217-b60149baa694", "value": "T1C6734AC4E5C3A8F6ED221978207B5B778B37F23A5539DA97C798A933DC11A40D20239D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308604, "uuid": "cbca1c93-5d3b-4350-a0a1-96e8a2008974", "value": "1536:q+K+a+h7Gc3zZI/b+Fsm2a7AFWQL1mNanugSbKx8JOcScCu:q+K+j7Gc3zGT+Fqa7AgQJSaugfkOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651308604, "uuid": "55c120b8-dbc4-4282-8b15-0b1313a790d1", "value": 75764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651308604, "uuid": "edffd9ae-af9e-452e-9e77-6b0dbc0855ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308604, "uuid": "d6898082-573c-4bbe-8efa-80c041a7c69f", "value": "gx86-20220430-0850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c116af-c845-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651296341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651296341, "uuid": "aec08265-eaad-4bed-a666-4b163ca35c86", "comment": "Malware payload (RedLineStealer)", "value": "565565fda8f0a8be150a34fb1c287f9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651296341, "uuid": "7e894dba-bf75-4ee8-88cd-9b65cf7eb11f", "comment": "Malware payload (RedLineStealer)", "value": "500c22f0aa45e310d0dd6f318203dfdee61a907c1bd86cb9c7d972dcbc63439e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651296341, "uuid": "419002ac-b327-40aa-ae75-4d38d7f3b937", "comment": "Malware payload (RedLineStealer)", "value": "40ac60e8277b12b1438bf917b4bb4ec27ff9d74c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651296341, "uuid": "28756fa3-54ad-4a1c-bd00-ed6a6d68242c", "comment": "Malware payload (RedLineStealer)", "value": "65a8ffc8f5572703d8c076af661f7c50869fce856dafc845287a495efb2cd0533ca5f52ed369fa71d1de4b29bb136582", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651296341, "uuid": "b012ed99-ed11-472c-8b33-d3f4ed852dfc", "value": "T18CC59C25A9E325C9C40EC1B7E90FC3DB58CD58B84F4BB9CF14AAD16610A11F38BB6971", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651296341, "uuid": "d76c081f-b988-4923-9eda-6cd6e6127056", "value": "0b03284c539b82930eb9ac2b7c0ea500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651296341, "uuid": "9d917f09-cda7-4bdd-b059-6863fdc81236", "value": "12288:WLIPXr7/Q+65y+h+3j/ed/Kk/hXwmfUe8QBgwtoh4KHTkcztQOrHbCXU8k8k8k8k:Wq77dkPhb/6e8OgSoh4iVtTrGXUFFFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651296341, "uuid": "e92862df-43ba-456a-89cb-9bafe3c2b52d", "value": 2538505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651296341, "uuid": "c54f5080-5215-48da-8e40-e70f78c60bf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651296341, "uuid": "ed48153a-5f47-497b-83b2-a39bd393e19a", "value": "500C22F0AA45E310D0DD6F318203DFDEE61A907C1BD86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7e9b3b-c868-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651311376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311376, "uuid": "bdb882f1-0865-49f9-9aa9-53d7d832758d", "comment": "Malware payload (SnakeKeylogger)", "value": "ee09c9180b02823bae6325adc4faa29f", "object_relation": "md5", "Tag": [ { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311376, "uuid": "84c65943-6276-4942-9365-f88f45ca382c", "comment": "Malware payload (SnakeKeylogger)", "value": "50ea2e36933ccc85d900166deb8ef6a0453771757ee000ee5254dbf0799d3ed8", "object_relation": "sha256", "Tag": [ { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311376, "uuid": "81a92035-a847-4146-84ec-fa75162bd875", "comment": "Malware payload (SnakeKeylogger)", "value": "da0ff6d2cfb244e644ba7f7d666da8ad8b1c7204", "object_relation": "sha1", "Tag": [ { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311376, "uuid": "53bfc062-fb62-47ec-bd6d-5ffb6acd0c84", "comment": "Malware payload (SnakeKeylogger)", "value": "6510d7ade5ae6a694bfcc0be7be26390239c811bba3cee04576482ded94a06531a09f0b3145d01707312dc1234bf9fcd", "object_relation": "sha3-384", "Tag": [ { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651311376, "uuid": "12bf16c8-6acb-42a7-8f6d-dedbd0ca2e6f", "value": "T1DF9423614538A6EEF8EED8C04BAFB7F6470F75ECF08152A6F60B85E01544AB471DA4C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651311376, "uuid": "372c3063-1e68-4193-823b-73762c38aac6", "value": "12288:xzFeTeoEW1WTJaqSgI4kVFNiR93sa3yUX+5j:RsTvW1aqnIDVFNiR93oUXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651311376, "uuid": "74cde0f9-ac75-41ed-8a7d-b974c8e27e6e", "value": 440578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651311376, "uuid": "f6a65e3a-086d-4d4f-8f24-8d194892c5cd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651311376, "uuid": "84c116e4-9abe-4eef-87e1-4b2f99b9ede9", "value": "57m\ufffd LPG SEMI TRAILER 7 NOS.pdf.lz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa90cdf-c823-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651281748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651281748, "uuid": "967a0aac-d5b5-4ab0-9bb3-3a980b7b7ab6", "comment": "Malware payload (Heodo)", "value": "45661b7e4d71d69136499495814d4bfc", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651281748, "uuid": "c3c28e05-8eed-4285-bab3-b97c2a266be8", "comment": "Malware payload (Heodo)", "value": "50fe5b0c0b74695398af98c916720ad6881be75caa76bda091cdf5385959fdae", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651281748, "uuid": "c2dd0462-e2e8-42e6-9818-02167cc7b9e7", "comment": "Malware payload (Heodo)", "value": "43fb493a863f87fefcc98a48efc33e54addcfbb8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651281748, "uuid": "2dbe3dc8-ad8e-4309-b266-8b023778d4ce", "comment": "Malware payload (Heodo)", "value": "bf1b4416bdafe68216829882c304d4cd80247e630d24a44de53d886353426f386611c21b371ab06ed4272f24667614ed", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651281748, "uuid": "c4b3df5c-c5ce-4e1b-9783-709461521a18", "value": "T10FC4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651281748, "uuid": "e5e9eef8-b4e1-45c1-b902-673904917c70", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651281748, "uuid": "0489586d-1b82-4487-8a15-aba624f2b17e", "value": "6144:JhZ02GdOOgPYCKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFftKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651281748, "uuid": "bc611f78-3143-4de6-af0a-2c6802423b9d", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651281748, "uuid": "29dc4d39-5c2d-41d3-a57a-b79cfbf8ac0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651281748, "uuid": "79062482-7af9-4ad4-9d8f-ba3a6918ef1a", "value": "45661b7e4d71d69136499495814d4bfc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2fd6844-c836-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651289833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289833, "uuid": "894ae556-d793-4ffd-b6ab-9fece1ffa7b3", "comment": "Malware payload (Mirai)", "value": "f358fee5c95251a8a3230c2f32b0ca88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289833, "uuid": "d04f2f0e-9a78-4b20-81db-51f7d6aba3eb", "comment": "Malware payload (Mirai)", "value": "5518059ab7dd38ea3120e8714b2bfe4f3a37e69bc86d230e74cbc9a41ef43038", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289833, "uuid": "bfa757d1-e7dd-411e-9c25-6cb4d6805397", "comment": "Malware payload (Mirai)", "value": "bfab66b8623c5bdc2b2ea9a094f0fe921442a7d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289833, "uuid": "adbfe934-59e1-4f18-9074-ce3730518fe6", "comment": "Malware payload (Mirai)", "value": "f5515666b4b1d237a7b553d9f080d3c4ef4011d95e592db8dd38524c58654e8c7d4fdd1b0ae0ec3e203a3b59c93540b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289833, "uuid": "8d423534-adc8-4ceb-b7ba-330dadbfbfa7", "value": "T1BC33F1F598153269816039B2FE3B248DBF4F17FE99B5B017182087E034FA821A9BD4D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289833, "uuid": "1178aae0-f47a-4c75-bdd2-6816ce21458b", "value": "1536:yM84IqZeG5nL3Aa6uDfOIeVomsPLIVmWjv:D84lZNAKDfOIeL0LamAv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651289833, "uuid": "0fcc104f-b51d-4ef2-b398-bc4b4514847d", "value": 53620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651289833, "uuid": "cd550a1e-4a61-4359-965c-b93e5cd368e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289833, "uuid": "99d2261c-74cd-4307-8ab7-c51dd1582b89", "value": "f358fee5c95251a8a3230c2f32b0ca88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea5ed12a-c86a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651312206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651312206, "uuid": "556b3210-25b5-4afb-a5ee-b8dda4f02afd", "comment": "Malware payload (Mirai)", "value": "d5e34c6b10938c003dd9823e57d17244", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651312206, "uuid": "88674909-6137-4bde-a875-354d3ca5b619", "comment": "Malware payload (Mirai)", "value": "57b1a1040a8f604b2d32361a3f2596857e53967dfa3e13eaef09ec43ee2a43e2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651312206, "uuid": "5e4ef7e4-264b-41c0-9e2f-24f06b6834b7", "comment": "Malware payload (Mirai)", "value": "54bf2ba52c116ee36b1a4738d58540871a8b05f6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651312206, "uuid": "7fdd0f23-f079-4a3e-8f0a-d56a875589c7", "comment": "Malware payload (Mirai)", "value": "8c952b9a0481be248cc57f58817321aeebface307d595d11a71c10a1c5bd394efc9d4e8893b288cdefe9bf1c51f3dfad", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651312206, "uuid": "984508ef-55d3-421b-834b-3c5eda04a43d", "value": "T1ECF2E1359EAFE436E6B1C87676188B45E2A3077584FE70729B10006327875178CFBADB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651312206, "uuid": "85127eda-f349-451d-ab2f-9499e43fae76", "value": "768:gtofIBBMsfbqUawuPa3cudj2AZcnw5FoGIIPcFchsZfozs3UozrR:gtoE/pa9Ctx29QeGrgxfoez9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651312206, "uuid": "5532ebb1-2c89-44f6-9412-186f46c1368a", "value": 36868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651312206, "uuid": "c054179f-c78b-4fa0-be6c-182f3d2e40de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651312206, "uuid": "5ca0665c-efe1-418c-8a37-5305755b30fc", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b5bc100-c818-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651276855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276855, "uuid": "77696270-e7e4-4bb2-b343-c09b19b4898b", "comment": "Malware payload (Heodo)", "value": "323019d88be0df6e0facc508b2ced920", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276855, "uuid": "4b77da9b-50c6-4d71-b3dc-8537d2b6d7ca", "comment": "Malware payload (Heodo)", "value": "585b2ff2cafe67dba07b79470960033843c3f5804ff9f21106e6c49ae593790a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276855, "uuid": "219feecd-dd9d-430d-ba55-dc22af0f9456", "comment": "Malware payload (Heodo)", "value": "38c9e7e955f6bee47d77c609a90d8b7abcbf1d1f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276855, "uuid": "99b64d9a-09d0-42e3-b65e-91c797453dd0", "comment": "Malware payload (Heodo)", "value": "fa54cfae897592a01a6376a2c869806854a5a8abeb41c8441b4e5076387e6a20b63789f5aeda0eda95c33be793f45939", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276855, "uuid": "6962c086-7c2f-429a-b5a7-b2772dbde3e2", "value": "T1B5C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276855, "uuid": "715faca1-06c6-49f6-aff0-a8c0c9b91309", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276855, "uuid": "6f713208-85ce-4988-82f2-0fe5eeb612fb", "value": "6144:JhZ02GdOOgPYjKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfwKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651276855, "uuid": "08eade6e-f107-4ddf-b6c0-28572a1274ad", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651276855, "uuid": "229a429d-2e41-481d-9470-74f74894e47b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276855, "uuid": "192ebfb6-89cc-4fec-ba63-0bf2e75ab544", "value": "emotet_exe_e4_585b2ff2cafe67dba07b79470960033843c3f5804ff9f21106e6c49ae593790a_2022-04-30__000049.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6fa75a7-c853-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651302215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302215, "uuid": "6466e99a-6e53-497f-8a86-b44cb9bf1a16", "comment": "Malware payload (Loki)", "value": "193b9c164701d2625bbffa0488c76ca2", "object_relation": "md5", "Tag": [ { "name": "Barclays", "colour": "#99178C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302215, "uuid": "09bfaa6c-be4c-4b57-a796-2837451a3b95", "comment": "Malware payload (Loki)", "value": "58d744dbb828bb01e1855d486086e90fe91505a8177be1dcd98711402798001e", "object_relation": "sha256", "Tag": [ { "name": "Barclays", "colour": "#99178C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302215, "uuid": "b00321e3-41d2-4f08-ade0-3500005565e4", "comment": "Malware payload (Loki)", "value": "82151903c4b8f7ce0da3a9a715c5723f4ed60de4", "object_relation": "sha1", "Tag": [ { "name": "Barclays", "colour": "#99178C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302215, "uuid": "0a42cf8e-d674-4457-8cb3-03c751abc17f", "comment": "Malware payload (Loki)", "value": "39e7f3499f3b7c1a5d64864e376ff9514447cb8b93961ce6ae012edf72d061ee0edd910242233aacd859236fe6aad02a", "object_relation": "sha3-384", "Tag": [ { "name": "Barclays", "colour": "#99178C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651302215, "uuid": "624e3bd9-a2e0-4c21-a91f-3b66f82e6cbb", "value": "T101B48B023E9CB6DAF92C06B90826E1707BB8ED956D20DE4A1AF57EDBF530700D540A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651302215, "uuid": "dbf5fba7-d55b-4a65-ae26-0f84de2a3400", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651302215, "uuid": "c1b4f159-fdbb-4702-b478-c7e71a62f668", "value": "12288:y5/uf5CmcRKSGglYG81TyV211EU58Fi4:Dfk7RZTiGOPEU5iT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651302215, "uuid": "bce4a2d1-4785-4ab9-85c0-dee4e6410a7b", "value": 511488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651302215, "uuid": "abcaa1b0-630f-48a7-aa50-df8b1776ed73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651302215, "uuid": "b598c090-6079-4671-b12d-cde8952010dd", "value": "Barclays-#700339Customer Order #47132.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83eb69d-c875-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651316927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651316927, "uuid": "242d994b-d514-497f-8c60-a1350b1ddc2e", "comment": "Malware payload", "value": "71fc5f0437a652925ddd5c4ae469287c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651316927, "uuid": "5da84446-6153-4ea4-9cb2-a86d3c97c6b0", "comment": "Malware payload", "value": "595ba6129442095db13c862293cac15a6e9f43d49e9e2f86145361949d5a01fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651316927, "uuid": "7aa3c483-ddc5-44ec-93e7-d50c1c0cf6a5", "comment": "Malware payload", "value": "7caa9301e8f3ecc71551d212f8e8e75b91d35e73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651316927, "uuid": "57347a3d-139e-414a-98b9-91155827a28d", "comment": "Malware payload", "value": "7d46633bfb65e5801806d70a5a964d28cdd354d41765ee25294af5ae7bbd004ae1254160bcf409db671d2465f12f346b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651316927, "uuid": "e21029bd-2a87-4be6-969a-5070a80f0a94", "value": "T17CC23B41BA18A853CE158FFAC9CB91104B756F47B080CEE6699EB0D66653BE30606DCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651316927, "uuid": "a5c54eac-8991-46cc-9a5c-a62bc67db3af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651316927, "uuid": "780c446f-006d-452c-ae28-ca8ded76a317", "value": "384:zRVZveHMRTjy4LE7GWNHRIA8FYTMm+5grcWB2+PYN4fUC4I/AfLRKtU9j9hOy5:VVZNxGNH4YTMZH028Ycal9hR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651316927, "uuid": "239290ee-2711-472d-9865-0161a13ae46c", "value": 28208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651316927, "uuid": "8a7c2a96-109f-4b77-8ea2-09976b1d51a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651316927, "uuid": "590f539c-75e0-4f96-8aa7-27f881a14b3f", "value": "2022-03 E-CATALOG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c5ecfb-c86d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651313324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651313324, "uuid": "590f13b0-bcc4-4526-91a9-312845c1b334", "comment": "Malware payload", "value": "27ac40a34c7b5d19d21e72ccac3d93d5", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651313324, "uuid": "c05dec7e-b70b-4e75-9e20-3713f283f39b", "comment": "Malware payload", "value": "5964efaa76919b34a74b2cc74f58a5f765a2f8c79f6a7ba2b315928cd7c98d55", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651313324, "uuid": "52aaa9c7-c979-4139-a727-d625d91c0fb8", "comment": "Malware payload", "value": "171bb21e8f64e713b20d79359f4eb7e4f2c005d3", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651313324, "uuid": "d0a200aa-cff0-4a4e-8234-31737c9cfb0e", "comment": "Malware payload", "value": "6c88c6f9e3739dbfd0ffe03272ffc9971af3f954bd66d0dc01eb04ec1817e59f7d402ddccec87557287b33407a8f50b6", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651313324, "uuid": "fd940640-6242-46d2-99e1-ca5ebda1670c", "value": "T15D13E8AAF6D9E805D9050B3548EBD6FA3223BC229F9B53473289F71E0EB1580CB43557", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651313324, "uuid": "fa700ec9-f843-4deb-9d58-69c503ddacdc", "value": "768:mqoMKpbdrHYrMue8q7QPX+5xtekEd/68/dgA1AoWsXJZA1f97vbwc4AqTR8Myv62:XtKpbdrHYrMue8q7QPX+5xtekEdi8/d4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651313324, "uuid": "8a1b190f-478f-4039-8195-9d001f072847", "value": 45061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651313324, "uuid": "6240f0aa-5941-4b40-8a2e-67522a036059", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651313324, "uuid": "1a271caa-3d13-4069-af50-b9c3ff2240f5", "value": "funds_transfer2414.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d94ab5b-c8af-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651341605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651341605, "uuid": "72240914-3955-4c69-a527-95187b7c7d0f", "comment": "Malware payload (Mirai)", "value": "93acc91b17e9cb708210d4f6be8cef29", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651341605, "uuid": "4f8982ce-a5de-463a-b5e7-21734b6a5136", "comment": "Malware payload (Mirai)", "value": "5b107b1cc6f8476a58f27cf9559b7873632217ee57ae79b3e6f83bb8aa3c4c1d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651341605, "uuid": "f12f24c7-170e-4913-b335-cfc0abaf3971", "comment": "Malware payload (Mirai)", "value": "b8cf0c30af978eacaf2821aee71025d40318865b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651341605, "uuid": "253e832c-70aa-473c-961c-326ddad6ff3f", "comment": "Malware payload (Mirai)", "value": "a4997ccaaa29b93fdec4b78755b9eb9fe85b0d16885038a89eb3f8c78f727681fc5d762e2ca6b42ebfb8ae435054ef97", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651341605, "uuid": "6a933563-4f2a-4ef8-80f4-abb893bc1f48", "value": "T1B892CF1F51CF4A9AD82B03B9A51A0DBEBF013CDA0B9FDD090601D6E212F215A8F361CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651341605, "uuid": "37e71bac-f245-40e5-b988-ab78b59c9cdd", "value": "384:MQbB7BBEuOzn6Wc5C3GAAqv7moC58Mmd876oCBow5wug32rlN7Qyn0AgYZH3Lv1+:f7BwjfLn9moP1876oCGw5wug32oy0HQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651341605, "uuid": "6362a99e-375c-4c42-a1f3-b6c1129ee4a1", "value": 19604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651341605, "uuid": "ac4c78d3-e19a-4e2d-a1e4-dda098f9e9d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651341605, "uuid": "f1297f5a-f1c2-4430-a446-692af8cac87b", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5e37d8-c8ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651346517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651346517, "uuid": "f74165dd-4b8c-44d8-a281-1d35aa805e20", "comment": "Malware payload (Mirai)", "value": "2eaf4c9eb5d0da736316a8cfd0d1153e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651346517, "uuid": "6dc0d5d7-6925-4329-b4fc-1056480f913e", "comment": "Malware payload (Mirai)", "value": "5be218d2582ea64e9fa1dc82d614afeca3e66c40fe29f4db3f62ef8698364882", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651346517, "uuid": "2694445e-a667-4a40-a4fa-c1a90b2895c4", "comment": "Malware payload (Mirai)", "value": "e69906e3e6015f775d7a976203dce8cdf73e659d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651346517, "uuid": "ba98509b-8378-48a9-84ed-1eada5fd0b1b", "comment": "Malware payload (Mirai)", "value": "9b6d83986778cc57efff69c6dca462a8a72b0413106b7f07846b6ca86d424b943d333c9345648fd465863b976218be81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651346517, "uuid": "5a83119e-fbe5-4a32-ab05-31bc7cbd1ab4", "value": "T118C2D090D795A4A2CDE80C76FD7D4D868B5B4FB8B9A730FA3B4006726C8803206FC54B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651346517, "uuid": "d5fa7c77-3054-4814-8782-21aae020bd29", "value": "384:YrQ9oY8gaz/YkZpPc0kgjsBSZBhTkbx7bm71mo/L93/RPu76UAdl2mdGU5E4:kQ9I/YYPc0kW+OLIbhsoex3KVe23UT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651346517, "uuid": "2536aaa5-261b-4c89-9b7e-0fde603ca209", "value": 26932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651346517, "uuid": "104b9c11-80a0-4fcf-b825-7cd21be360b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651346517, "uuid": "8d87f0af-a73e-49dc-9100-3df3c1cd04d9", "value": "2eaf4c9eb5d0da736316a8cfd0d1153e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "992f9f4f-c850-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651300903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651300903, "uuid": "ef8b6b4b-e573-46cf-9352-de88ed67baa1", "comment": "Malware payload (Formbook)", "value": "55b1ad8ab26a1ff30c7d6221f56fe034", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651300903, "uuid": "eebcd670-e9c8-4eba-83f8-d8c1a47508d6", "comment": "Malware payload (Formbook)", "value": "5c81d965df72cd6e5a0d26766972e0a84a9aef4015f637e7b3f883479bf102d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651300903, "uuid": "76643929-df03-4384-b6e4-a0bf1be15e1b", "comment": "Malware payload (Formbook)", "value": "e22e9389bdd8766afe7c563df73bf66c0e8c6f56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651300903, "uuid": "fb3c9cdc-e49f-4cd4-805c-15fff4ecb01c", "comment": "Malware payload (Formbook)", "value": "7bfeb04f806190f72f9ecf298ca2bb72fdcbc742cc06c89eba4d007f1fe9b779b00792bee0316853df8d64e76f7a168e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651300903, "uuid": "11cfa0d7-6460-4d32-8d89-541507641a9c", "value": "T1AE14020027E6D933D4E25B721E3F1737DBFBA9221274461F13A01AAEBD61B41860E767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651300903, "uuid": "b1eafd47-22f4-497d-964c-d1f77f74bed3", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651300903, "uuid": "fc8bb8af-4447-45ee-8f7d-332c5c104c8a", "value": "3072:l1NjcVVnLpPunbLW3gNxnAxIKAnl3t3f2UGfzPSLTZMXuH6TsQs9cH3CR/DxsmfO:HNeZmLdfAx1ijGWpAwP+XMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651300903, "uuid": "a9e3c933-fb9d-4ec2-8604-96e64e100b8f", "value": 196619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651300903, "uuid": "4d2a5e00-d151-4a2a-9c20-56c1cfb42de5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651300903, "uuid": "3ff3732b-047c-4ac5-a4c6-fcd9f7a054ad", "value": "PI160256.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca9b476-c842-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651295030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651295030, "uuid": "6cc7460f-244e-49b2-ac0f-bde61fa59962", "comment": "Malware payload (AgentTesla)", "value": "b012cb8cfee0062632817d12d43f98b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651295030, "uuid": "1da1129b-0ce7-4665-a875-1a36ce1065af", "comment": "Malware payload (AgentTesla)", "value": "5e6640ff6983ee67ee8157c4eb5cc1f3ed443389976b5760370631cbd70e8593", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651295030, "uuid": "cc7ac003-db63-4467-b5dd-1464a10e9a6d", "comment": "Malware payload (AgentTesla)", "value": "8a21aa3a787290e02247a78ab5b4bf01e58d8ad3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651295030, "uuid": "b3e77062-3d19-45c2-82f7-ae5c53c907ba", "comment": "Malware payload (AgentTesla)", "value": "60cfa0f1654286e7e3b6bb52eae6a673af1bd349e80baeb3fdcb1373540de126c0240ca74a52f5081625c8f70abd4956", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651295030, "uuid": "c2628d69-e8a6-445d-89a9-53e15bc34285", "value": "T1D4D4ADE2364C9AD3CE7649760ACF9F6113A345211122F733ABD377F6364261BEA27184", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651295030, "uuid": "eb19b2fc-f772-4ed6-91dc-0795916c3dce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651295030, "uuid": "99f30b10-f061-4702-97e4-fa45c39109a1", "value": "12288:6Ih1SHbhZngCtFcB2slhqVfNQoMe7eL73EzVpnG7tlgMh:7gLng8c3lMHeL73O9GsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651295030, "uuid": "63aff9c8-9d1c-4cab-bde2-236e04aa350b", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651295030, "uuid": "37b40263-ff91-4f13-903f-059de87bbc24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651295030, "uuid": "c631ab18-e2b3-4573-95bc-89184b006a30", "value": "JCTRANS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b7f56e-c853-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1651302051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302051, "uuid": "66eab62b-4de5-45fa-b626-0040733f97a5", "comment": "Malware payload (AveMariaRAT)", "value": "7e0967d8d88db9453ae9de529b7b4df0", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302051, "uuid": "9c34ce00-ce70-4cf6-b89a-a9c226d2fc47", "comment": "Malware payload (AveMariaRAT)", "value": "5f52eb5029a3f548a7b40e51eac5ecb67224e107f2bf7b3972ea930b2f6b29f4", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302051, "uuid": "61802834-7c6b-4b8a-846b-fb1073150873", "comment": "Malware payload (AveMariaRAT)", "value": "23790e4feba6d2e7a992a0c40ddf282518b028c6", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302051, "uuid": "7012d96d-a983-498a-8407-d29b62f7186c", "comment": "Malware payload (AveMariaRAT)", "value": "39a1bf27a93bf8f9d20044d0f55b7708a789269c8bb2bd91d8008e05c2a397009bb3d5d694cc3171086b5cf0775c18cc", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651302051, "uuid": "2dfdfd8e-cd1e-494c-88e7-92e17818b463", "value": "T15F75F116F3C537B0E2AE927A85F6892D93B2745213B1D38EA750858939233528D3DF1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651302051, "uuid": "91663367-7c4a-4d6f-8a9e-0e5feb6ed90e", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651302051, "uuid": "87fca556-cc70-4c52-8307-febe51d658b7", "value": "24576:J9bkqF22uX1iA6qsfdjKeL77MTqrcdlacz5i35h6ARg3SSpkbO73y9s:DbkUbqsljKeQQcWczGh5Wpmy3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651302051, "uuid": "e6551e33-c896-4873-a2f8-84cbff70f71a", "value": 1668096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651302051, "uuid": "4b1cd352-bc27-4df7-a3c8-477245b670e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651302051, "uuid": "fee01799-c8e1-4d5c-84c7-80e7bfb8a062", "value": "meetinginfo.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea691bd-c82f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651286900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286900, "uuid": "9e0239d8-5329-410a-a651-0161dcdacafa", "comment": "Malware payload (Mirai)", "value": "919e221d8099626f8491e9a06358207e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286900, "uuid": "ff8de0f2-ccbc-4f88-bd48-97527133ea10", "comment": "Malware payload (Mirai)", "value": "5ff544b72eaadfca1f8d92b6eb97b015c40d598811ce8810917b8d527f60adf9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286900, "uuid": "241b06f5-cf94-4cd0-ac32-c92d610bc0fd", "comment": "Malware payload (Mirai)", "value": "52379db9e9048c3652ce6286d14d0e91f7e1f356", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286900, "uuid": "22dfda58-acaa-438c-b870-6f41c88137e5", "comment": "Malware payload (Mirai)", "value": "1b2a5b56860d908c4af5a604fac400b08c81238a3fb3428d7d6df4632a99acdbb662d648beb01a4c629561bb0a122cf8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651286900, "uuid": "0ea4bed7-ca03-4217-b527-376a62a4efce", "value": "T185535C01B35C4E47F5E61EF9393F1BE493AFED8022E5F484690ED60A8135F32594AE98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651286900, "uuid": "f0aace5f-a384-48ee-8b01-48d300a2fdd5", "value": "768:ad6PG21purk5OFZ6GRzvl+xI97sJh725i3Ok0cjH/i8RyzKLVvNfuFhpmhcZKhIa:K6O25mv8vm0TK8RyCV4pmhZWx3Lu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651286900, "uuid": "a822384f-6d2c-4cce-9b79-85f5245812f3", "value": 63720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651286900, "uuid": "acb9e730-bfa5-4edd-aba3-e7c0e3abbf15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651286900, "uuid": "12e00288-18f8-4a34-bf41-e7ba8a2a0675", "value": "919e221d8099626f8491e9a06358207e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b53e0475-c823-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1651281623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651281623, "uuid": "95a0ebe8-cbcd-4c65-9a3e-43c1aa2988f4", "comment": "Malware payload (Gh0stRAT)", "value": "2265d1e20871b291702725122b87c7f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651281623, "uuid": "7d930272-df4e-4b3a-9ae7-af729cd251a9", "comment": "Malware payload (Gh0stRAT)", "value": "6154f7c1da7c0cd458335c77f87c36a569e1c719fcd2f48c7959c4fa20d296e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651281623, "uuid": "fe961d7a-3084-4fae-b6b8-5487f64b5e1a", "comment": "Malware payload (Gh0stRAT)", "value": "94b54db6841b550e1e0569896766ae171c5e8773", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651281623, "uuid": "c75d06d7-0336-4f59-911a-cd38dc0843cf", "comment": "Malware payload (Gh0stRAT)", "value": "3691e8138976fe8ce2fb80e1935a5e7349574d703920419aafb22c4f2ee4bbbdb9031247de3024220e0c547b01a3ceb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651281623, "uuid": "9bfbb78f-9050-4811-9631-443394830ec7", "value": "T1C7D38E12F68680FAFA66047474EB3777AA3768B4460C5E837716DE511833195FE3238B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651281623, "uuid": "aef853c4-458f-4c49-bba8-5233661cb1b9", "value": "08d5f5901bd0e783b167b765d5831072", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651281623, "uuid": "f55570ba-8a6c-4f20-8f6c-f93f325c02cb", "value": "3072:o2NmT1IcoHRLkOJuiNS8xjXGhPp768jiGAzachcMen8D:oHT1Ic+fciN3xjXoxrjxvcOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651281623, "uuid": "00a34b77-fb72-4b64-9e86-763169b137a7", "value": 141824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651281623, "uuid": "139117a3-8ad4-419a-aea1-6e9d43d69f62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651281623, "uuid": "fe48178c-567f-4e27-9097-91aa5fd6a2c4", "value": "6154F7C1DA7C0CD458335C77F87C36A569E1C719FCD2F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f308d2-c851-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651301215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301215, "uuid": "687d1613-c244-450b-904c-e71f5e35de79", "comment": "Malware payload (AgentTesla)", "value": "1294d354dec3d4bfa828ea403a2653c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301215, "uuid": "b24b5ec2-2428-4fed-99c5-abbcc7da2f60", "comment": "Malware payload (AgentTesla)", "value": "621f8aab845b2b4ecbb2ec64ec127102ec9b8341cfbe3c9a090d1ea865786c94", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301215, "uuid": "2bb29509-1926-49d7-a61e-aea8428ed44b", "comment": "Malware payload (AgentTesla)", "value": "f2908466a3a1634bb2d77afc3adcf4e3c1baa79d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301215, "uuid": "b9e05a84-287b-4d1c-89ff-ad0316042c62", "comment": "Malware payload (AgentTesla)", "value": "5eefa958e48e307ffd5f2d1e7a650f74fa34ab1df330394389dc11605579332b8bbf45f751273d970655e8d894212001", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301215, "uuid": "794cf692-dfe1-446a-94e7-0f85c300e677", "value": "T12794221F792C7A82562A71B8767D00A5074C13D6FFA0A9E8F41FC9E799485D9089BCF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301215, "uuid": "74ab4538-140d-4e1a-a267-59f1f368e666", "value": "12288:AD6udcqOS0iEyQCX+DKW6ED4JK9QYpO43iipi:a6uyVWE3W9E0YB3i2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651301215, "uuid": "479df30a-127a-476e-954a-be06c465730b", "value": 418586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651301215, "uuid": "ccfba781-f077-4c87-9cb7-51225a721f7c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301215, "uuid": "fa395713-64ca-411c-a937-3a31ffb5a252", "value": "Attachments.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71880584-c8a7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651338203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651338203, "uuid": "c86d14d9-8a53-4612-a0b1-6fd80201601d", "comment": "Malware payload (Mirai)", "value": "6139d748945c9678b11076600b04bd9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651338203, "uuid": "5fabd9bf-1e6b-4543-8ac1-2cf7d002a0d9", "comment": "Malware payload (Mirai)", "value": "623c076b4bda9a6604c019ab4a7f99ebf7a71189adb4fbd4a533044d6279bcb0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651338203, "uuid": "f6112005-1c09-46af-819a-a6dcc891075d", "comment": "Malware payload (Mirai)", "value": "c2d282bdc2855a983be63a8aeb58b79e9a3f1df2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651338203, "uuid": "cabe0dfd-1df9-4b26-91ad-1943f3ded386", "comment": "Malware payload (Mirai)", "value": "3334b0ed9e63abf0c7755040a7baf4367dfb08ff168b8747a9720524221aad9164c92486f2dd706713f67bcf6c79a1b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651338203, "uuid": "895a9ad6-2f96-4d8e-9f27-6672891b3624", "value": "T184D318D3B900DFE6F40BEE7604D74B25A230BFA11F921666720B39679D361D6282BF41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651338203, "uuid": "89259267-f96d-442b-9386-4b5cef8f83eb", "value": "3072:51Ti91TtgXd/kfqig/sytL7Nem9/stubwAGTLNg:5ZeL8lkfqi7ytXgm9/stubwAGTLNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651338203, "uuid": "b7d41937-e734-4d4d-82e7-585d7fe768cb", "value": 133330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651338203, "uuid": "8d541ea4-7a37-4533-9897-f63a7d702707", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651338203, "uuid": "777d5b51-d07c-4a63-b487-45767861d7e2", "value": "6139d748945c9678b11076600b04bd9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea70367-c83d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651292617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292617, "uuid": "5576ee43-5c5c-42aa-b204-740d8351e9c4", "comment": "Malware payload (Mirai)", "value": "10fd8b24813dd6d798b9b73cb393b68a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292617, "uuid": "a556b5db-6007-4210-a844-9923c7102e15", "comment": "Malware payload (Mirai)", "value": "63f415f8cd4108bd40e9c703d0225d5d78002953f8d1276609b2603e43e4ae31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292617, "uuid": "eb7213b7-5996-49b5-8e2e-5d4050b616e7", "comment": "Malware payload (Mirai)", "value": "e4b9c1f93a034453a23593e55857306c30748ef5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292617, "uuid": "c87f0396-b58a-4a10-921a-5aa6ce771911", "comment": "Malware payload (Mirai)", "value": "dab48a4a22122a9ead1efb19f2ab70991dcdc3c8a2f65eee0a9f37d91dbab04dfda62422bbf0cc83574dccd388eca70d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292617, "uuid": "d896ea87-a3b5-46a4-86b8-226c1afae73e", "value": "T10CB3C40ABF610FF7E8ABEC3745A92B05249D550B21A97B75B930D828F61B60F19D3C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292617, "uuid": "88fbddfa-3980-4a64-9028-a616bf623423", "value": "1536:g9DYWFx+xx+AaEPi1MR2jk2EkZ+BzYTjKoOvDBgplbngVZ14hvG:gqWFx+xUA0+R2hEkZ+BopZK1+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651292617, "uuid": "9bedad4e-7cdd-40b0-a9e4-7ce0261df137", "value": 108960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651292617, "uuid": "4d80e49c-674d-4b2c-8a7b-f5ee33a6dba2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292617, "uuid": "07e15ac8-e795-45fa-809d-a1bfb47f5a36", "value": "10fd8b24813dd6d798b9b73cb393b68a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c69e15c5-c835-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651289383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289383, "uuid": "b4cbb2d0-912a-4f3f-95d1-a8d2261d8180", "comment": "Malware payload (Heodo)", "value": "98ff8222b427bab33a1d5cfb374aaafd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289383, "uuid": "89872433-9ddd-4d97-8daa-9d5008a54b03", "comment": "Malware payload (Heodo)", "value": "69c9120eaef2ef7a4f6429eeee763e586bc6814515ec20d994a6f418b07234f3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289383, "uuid": "3832d0f0-f8f9-4dcf-89a5-16c2eb14d0f2", "comment": "Malware payload (Heodo)", "value": "752f04b055f1bc01360b2e890636b69ecf3c1492", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289383, "uuid": "60bc1775-fcc5-4f69-ad1f-4a3de946f657", "comment": "Malware payload (Heodo)", "value": "94361df17184af257b993c1b0bafdf7a7512e251a4def2dd576b12f5e5547f941759952885ff87205a969bf7ae7b573a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289383, "uuid": "f4889d75-0e35-4580-a697-f18ac0178d69", "value": "T1C3C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289383, "uuid": "e420ca79-a32d-446e-8dbb-8bbb7f4b91cc", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289383, "uuid": "23c2d6b8-7984-4463-a554-d313e032f225", "value": "6144:JhZ02GdOOgPYlKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfqKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651289383, "uuid": "230f33b3-f6ab-4021-9dab-980ba9bc9ac1", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651289383, "uuid": "94f56d3f-b82d-4cc1-9a2e-de61f4fbe188", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289383, "uuid": "4ed8c0c7-4b44-4804-b6a7-8ea6afc11038", "value": "SecuriteInfo.com.Trojan.GenericKDZ.87125.21294.5822", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca678fa1-c864-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651309575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651309575, "uuid": "0c8e61a0-9f4f-44bf-ba6c-3467aa76b6b5", "comment": "Malware payload (Mirai)", "value": "11a9ee2adc383685b18582836ece29a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651309575, "uuid": "210d3cbd-6486-47f3-b4b9-6fb4106cc90b", "comment": "Malware payload (Mirai)", "value": "6a337f02e7a4fbba6612a307973c103ac217c8185b928d429c71ec1f4c8928e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651309575, "uuid": "0e026e29-fdb4-48f9-b315-7ea0a5484037", "comment": "Malware payload (Mirai)", "value": "b4c43b773961052af22681b8d7047f6349163846", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651309575, "uuid": "3e9fc15e-b161-4c33-823e-cc24a39cfd4a", "comment": "Malware payload (Mirai)", "value": "3dfe4073957d773d92b05936ee3fcb627de5b4feb253d410bd8eff1adf2a8b6e3efb771e1033c83b65a694e5d6b35a74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651309575, "uuid": "04f8f2a8-8d2a-4c47-9275-576815a8f9b5", "value": "T1F0E2D04DA2DC184ADB6E8CBD81CB027182D622C6F3EF594D93548C647729D1F789D0EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651309575, "uuid": "a075de6a-e0d0-4ed8-b454-70e2b7b3d00e", "value": "768:A8JcDyJrO4FqpOO3kwtev7l+6Mjf8iMlRN5W0:HcSrB4kwK+Bf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651309575, "uuid": "3d4ee95e-0351-4c8f-ad31-c10dcaff8d47", "value": 33240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651309575, "uuid": "f42182bc-8640-4b80-8a14-5a14749777f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651309575, "uuid": "d122cb80-0176-4138-a7f3-b43d8bcaff5e", "value": "11a9ee2adc383685b18582836ece29a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a215be-c8ae-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651341275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651341275, "uuid": "794711d6-cb06-4533-92df-2bcb5787b2ae", "comment": "Malware payload (Mirai)", "value": "f6f437fa4293d9e28a77a155087da0af", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651341275, "uuid": "f6620ee8-3723-408a-92d7-8ca21960ec90", "comment": "Malware payload (Mirai)", "value": "6c0beb9bc1bd73b67bdfcde14916e0ce22531997924049030a474a6ef7bcd4ce", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651341275, "uuid": "592fa337-cdee-4e19-b82b-914ddf45f5e9", "comment": "Malware payload (Mirai)", "value": "8eed91b742eaaf5825f6755193f3f698bd20691a", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651341275, "uuid": "82780383-5c5a-4efb-b663-710b033ebe6d", "comment": "Malware payload (Mirai)", "value": "aecc04f0a12e8945ac7780db190cdb7357c6555d846814a25f1a6042956ceb5b33e58e46072e4fa4cc22a29ba21124a6", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651341275, "uuid": "6a6bd6f2-32f5-4f5a-a36b-24a49f53e82f", "value": "T132D3072B77B1C9FAC1C756B026DFA1D2D111FD3D0A32226B33847D602B3E9855A6E613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651341275, "uuid": "5b5629da-d466-4f63-a699-001ff006f056", "value": "3072:T8M9eWxrZkKOPj9AOUr+KzBQG+SSr5f6rR7Qwm6Fz8qtyOEnjNg:TpZkKOhdwB3pSNi17Qwm6Fz8qtyOEnjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651341275, "uuid": "113910e6-f3ef-413d-b894-671538494de1", "value": 137951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651341275, "uuid": "7fa982b8-d30b-4406-a64c-b10a47122309", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651341275, "uuid": "33489c78-c463-4fd8-bc91-d0785535ae4d", "value": "f6f437fa4293d9e28a77a155087da0af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb89c12e-c877-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651317738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317738, "uuid": "b36aafd6-df7d-42d6-a957-a2f704bc3e82", "comment": "Malware payload (Formbook)", "value": "478d99e899737d47395dfadb50593d74", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317738, "uuid": "ec6d37cf-52a5-43de-bf38-a31b8f644eed", "comment": "Malware payload (Formbook)", "value": "6c520dee771f3e01db3dfc21534b3ccdc27b839e91d6372f0602da6342b419da", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317738, "uuid": "c413bc30-55e2-4057-b1b9-90d5e8aef933", "comment": "Malware payload (Formbook)", "value": "0749d2084ae228f92cb1fbfb9bfa3e646c775abf", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317738, "uuid": "7a97cef7-9a3c-4a34-993a-36e43ddb8706", "comment": "Malware payload (Formbook)", "value": "65cf5a720db6633eb6bfa3d45cecf1712edd4c8c91572a0464b8ec492b5b256b1ab9878dc21d0b06b82c6d901fffc871", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651317738, "uuid": "1314ed90-435d-4723-a610-a7b38dda3a63", "value": "T1F2A42338241CE26FB67347599946FCE2ACB88DD84F432F0EFD681B8A8D0169142F25F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651317738, "uuid": "0ec447d5-1da5-4d6d-9080-785e2b5c4e58", "value": "6144:g+k9gNE33WyE0fpzJLqQqCjz5D19Vm4xgM+rsBGAETpupiZWfuB913rrx8VXPdUb:osQ9z3t+ATEpupi4fg3XaVfW4z1MH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651317738, "uuid": "f23f8c56-dbd4-4d10-bc94-14402427ce71", "value": 461006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651317738, "uuid": "561ed032-a6da-4601-8111-fef3c1f165ec", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651317738, "uuid": "7db65a82-b9fd-439a-a114-296d799c20bb", "value": "2022290857-ETA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d27ead6b-c894-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651330205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651330205, "uuid": "00023248-a8ea-4e18-8045-8c810d845435", "comment": "Malware payload (Mirai)", "value": "08d510821ab1c40e5c258b9f847ac506", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651330205, "uuid": "4d502ea2-2f23-474d-9b4e-ce4060a70ce4", "comment": "Malware payload (Mirai)", "value": "6c5a831ae676b1f4191c558ef99020f51726fa7744adfdd98a3cde7efb2ea01f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651330205, "uuid": "c0ca4fba-5bf5-4ebc-ac8e-90f3812fab0f", "comment": "Malware payload (Mirai)", "value": "dd14cd1c46296fa037dff4177e2a4496fc091aff", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651330205, "uuid": "c20135e8-d339-40b6-8c48-0b4620798b4c", "comment": "Malware payload (Mirai)", "value": "ad1c8329e33fc3fdf106984dbfb0518cb77c01de8fb42c1c4556a31079e172cf21822252d613f587f5f77d8a4bafbfcd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651330205, "uuid": "46bfb4b7-962c-4ecc-922b-48af423bfa67", "value": "T15AB2E011BAAC4DE2E5754C339F6C8393A34703BAD0D96540162A5A299DCE43730F6A6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651330205, "uuid": "c177f4bd-1237-4728-8bdd-38a324624218", "value": "768:79MhmNhHXqPpY5IpXetXpsIifmqAs3Uoz0:79QmNhHXqxRpXgXpUffz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651330205, "uuid": "47e9aa2a-a636-4b24-96dd-6bba7c1860b3", "value": 24648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651330205, "uuid": "64971392-6710-411a-b2fe-ef8169163b18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651330205, "uuid": "4e80f52a-5bae-424e-bdb1-98d12f93c785", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a73053-c875-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651316861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651316861, "uuid": "f0a85dd2-f8a2-4dfa-9810-e545ebed4b11", "comment": "Malware payload (AgentTesla)", "value": "16cfd4a9e45eecb3ae916c4e090b1435", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651316861, "uuid": "859725d5-0137-442c-8f3c-ebd3776ccf44", "comment": "Malware payload (AgentTesla)", "value": "6c7e2c78349d75eee9928d0291100cf7f06bdada738c4cb36fa4d52d58893f3b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651316861, "uuid": "39e5fe9f-808c-4647-883c-694651a22ebf", "comment": "Malware payload (AgentTesla)", "value": "7ee1aa92a3b20cecb71b35cde0c903a90507780d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651316861, "uuid": "9d8471ea-f386-48b8-97f1-566fc863a4d9", "comment": "Malware payload (AgentTesla)", "value": "a174d1520a6262fbe4139e9aa3670a7846e7d445794148ce0ef2b5e970ecec2af1f08964c1fa43836f26fc9ec9eb2afd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651316861, "uuid": "589a668c-cd6d-4890-a455-8258ebed4255", "value": "T16754238401ADD989CC967FAD9DF7A227B325B0362B3229C016DE1F214AC4F69E70057F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651316861, "uuid": "fe286efe-0f7e-4b93-a3bf-f7e0d5fba31c", "value": "6144:CVNGXlXR1rI8Uup9fSH4PLMTkZoS3Z5CO4+qrxRjqKbyfZmbZ6jlu:O4RR1rvJSYPWkZoSp4vlRjqKbr4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651316861, "uuid": "8b472d73-dd37-4a05-b079-2db84cebb95e", "value": 283335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651316861, "uuid": "7830631d-1482-4304-8572-7e4a81343b25", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651316861, "uuid": "ae484d7c-4d85-41d8-8aa2-e701c38eb2ab", "value": "Statement March 2022.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cacf0097-c851-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651301416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301416, "uuid": "64af65e5-3d39-4354-80c3-f2da67dc206f", "comment": "Malware payload (Formbook)", "value": "abdd543d6e2e9eb487053912b90deb04", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301416, "uuid": "d44fe9fe-0507-4e15-921f-d602034facab", "comment": "Malware payload (Formbook)", "value": "6c80921695c3306243bf3108004b527646535bd068b7deaa7e16191643bb5041", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301416, "uuid": "05d8b9f4-301e-411b-9553-105c97f2feef", "comment": "Malware payload (Formbook)", "value": "ba823383d0240b50a369c98c4f64a7c253f9772b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301416, "uuid": "645354e0-f816-4a71-aff6-0a86b39d83c5", "comment": "Malware payload (Formbook)", "value": "0761f91df7e78e8c7312d7fde400d3d55d824e27c28fbb073b5ba89ea35b0c5dfd5c0c2edda639835f825b4b6d138235", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301416, "uuid": "bbc35746-4133-4d75-be22-b6fe93c75666", "value": "T1A493E082812DFF4FFDA9C3B57BDAA0A8C1652ECD6A8B085DA861B3580135411B9D3E12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301416, "uuid": "b272200d-9d27-4fcd-8ae1-a95e3b8e9c99", "value": "1536:P3lgLwIIy7N0RUJvH0z9XF/PBvnKkZLdbXsoCXS3OdwggNAKwJ:P3sNIjUJs/PB/jtsoCzd6iKwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651301416, "uuid": "1d9a8998-bb5b-4312-a274-635c86398f57", "value": 96256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651301416, "uuid": "f17b524b-aab3-476a-8431-ec9b633e8322", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301416, "uuid": "e6f494d0-66e2-4807-be65-76903bc3d3db", "value": "721.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8541f42-c86a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651312203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651312203, "uuid": "7b163005-7aae-487b-bd4f-c562f5d5e3d7", "comment": "Malware payload (Mirai)", "value": "a6be47950e36c251cd5d52b38d69108d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651312203, "uuid": "a412152a-d503-45ac-bb03-f2124de47366", "comment": "Malware payload (Mirai)", "value": "6e56db4e8aff4a4406a42589938dfe158d600bd644f25c0e1b16b0c273302a9c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651312203, "uuid": "9415729a-b364-4b9f-b3b6-6834936d26f2", "comment": "Malware payload (Mirai)", "value": "35d59ad3aeeb7cc48fbd577eede90a6305c08c85", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651312203, "uuid": "9f37be77-6eeb-4a16-94c2-ecfd36f0e83c", "comment": "Malware payload (Mirai)", "value": "024915dd913c8c22e1e324720dcd52ae2d35ddc5e10bc8310f1fff1530fa4988b2b7c4c88352a31364a173d62a3cfa7e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651312203, "uuid": "0d5845c0-2d42-41b3-89cb-da7f9721f39f", "value": "T15734C753D3114D66E19C4EF1716B22407B92933AC6E76247E8194EF0BE86C5B09B3EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651312203, "uuid": "b84a0e9e-7ce3-4e02-b6b3-355777873f98", "value": "6144:kpQeZayTEaop3ko5JaSnwwM/9DIIGbmT2wIBV:CZayTEaop3NGJ/pbGbmT2waV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651312203, "uuid": "c8cafbc1-eddf-4a02-8a9d-ef5e0aa4db9a", "value": 241503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651312203, "uuid": "a78275c1-1046-4965-a71b-0720b8eaa316", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651312203, "uuid": "dd708d7e-be5e-4e49-a6df-b164aed02e55", "value": "garm7-20220430-0950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2045fa6-c82f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651286879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286879, "uuid": "b8e8110d-2fca-4805-9bc5-15ea92730162", "comment": "Malware payload (Mirai)", "value": "c133534b5c4834f5e7df9131ea56c9f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286879, "uuid": "7b7f0c8b-4150-4642-8a8f-42f1f8798a0c", "comment": "Malware payload (Mirai)", "value": "6f285b06ed109af7daa450edcc1035f78bbe48801a193321bd8ea8f3d7b9872b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286879, "uuid": "77896201-a3b7-4b33-9662-469ef62f0289", "comment": "Malware payload (Mirai)", "value": "b776e17fb9615885f027e0ee647160430e9f7e5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286879, "uuid": "059a2afb-74bd-416f-97c8-2af4d3de7dae", "comment": "Malware payload (Mirai)", "value": "8fc2db1c66256dd2dc26c286c93e2a141b47dcbe3b5c24c6777da8d96d583a6704a29ceb59f16ad785e77f1f9e971877", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651286879, "uuid": "4b0aa4e3-ad7b-4dff-a0f3-d612b415a142", "value": "T1345339C5E1C3E8F8EC140939307AABB2A977F13E7075ED9BD7D56533A911A02E21225C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651286879, "uuid": "1a0f3879-d680-46ec-90a8-4a5db0587ed2", "value": "1536:ENOVNTiAwK8bFiv8J17iOHItq1bLVcYzJWR6sQA+:AMME8bFivWik40bLVcamvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651286879, "uuid": "d5e782e1-39c8-4120-b569-eb633239aa60", "value": 62352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651286879, "uuid": "f585427f-12fb-4d63-a268-9cd256d9fba7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651286879, "uuid": "3ae6d56e-e139-43b3-b37a-5d9cbfd190fc", "value": "c133534b5c4834f5e7df9131ea56c9f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "368736e6-c8a3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651336386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651336386, "uuid": "68639ec1-982a-4136-ad56-11663b525e02", "comment": "Malware payload", "value": "2a21d57c9e791c5f45804c7cf0cb2fc8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651336386, "uuid": "f1dc4422-4196-42dd-8393-aa7db3868243", "comment": "Malware payload", "value": "718c6b8cb8cc397cdfe663920008c263402684b0ada16dcf671f96e0068c5a1a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651336386, "uuid": "4aad25f1-bc73-4a71-ab66-37874a33cfc7", "comment": "Malware payload", "value": "df2ea390c19593570c12d13700031c965f94d417", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651336386, "uuid": "67937156-4603-44cd-bad4-90d6e42cca8c", "comment": "Malware payload", "value": "3f9e658d1a7661ba36ebeb1ed8798067700909f27e375795a4b85e322ff0125b355431684e3097fce68b8794f3b732ec", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651336386, "uuid": "655623f9-34c4-4013-9f9c-735da370f588", "value": "T105C40876A5EE6CF1CD1561B994A6C91912B6BCC4EAF68F2F17402F350F2B34069F218C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651336386, "uuid": "f587a917-f954-4b82-80ea-73edf07d5d8d", "value": "7a8eae48cbeb9b498cff13262d717430", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651336386, "uuid": "88a9cdb2-f321-4b9a-8f62-4c636e3239b4", "value": "12288:aGalH7Y1KHh/6DplPyw3MUxqjZvqXmI4For:aGalH7vB/iPywR01vqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651336386, "uuid": "83d01527-4f9b-47fc-953d-d7bd4e45373b", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651336386, "uuid": "b0d3ee0b-6906-4fcb-9132-f04ed53e1f33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651336386, "uuid": "0ac67c3e-ad01-4d32-8421-f67f8b9c4d59", "value": "emotet_exe_e4_300eabead0138078b602be5c8c3e2293743ff3251e4aa5bcfffc6e8f14ac82d4_2022-04-30__163258.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c40a29c-c833-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651288238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651288238, "uuid": "79411af9-761c-4635-b4d6-7f2724c7e6f3", "comment": "Malware payload (RedLineStealer)", "value": "32c5dd7fe4c02f0e568d2399329287d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651288238, "uuid": "263f3170-2a3e-489d-a641-e2deca6cbc28", "comment": "Malware payload (RedLineStealer)", "value": "73a3a17e9cde2115af226c62a1ee11ce4c87e4e59fcf3c99690e04ad1a50749c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651288238, "uuid": "a97a7047-c94e-44d7-9c88-e1cd75606b2d", "comment": "Malware payload (RedLineStealer)", "value": "12ae2e031cbd69d26fa5efbc6e40def2e276a2d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651288238, "uuid": "6a4fa456-942e-40f2-bb5c-9c3e938be0b0", "comment": "Malware payload (RedLineStealer)", "value": "c3fce9a2c97f7bdf057cdfc1437eff4fc18626bd0ed257594e6c87db86c762f6e8778f99bd79474d512f07b7def8398c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651288238, "uuid": "7d84cfa3-1829-4708-9089-6bf05610488c", "value": "T11FC38023229CE633CB55AA7F1D5EB20102A17C811FF58E46FAC9B768D56D7C42640DB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651288238, "uuid": "6fa75710-e12f-4a2d-9a8b-2f733e6c3800", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651288238, "uuid": "fb811026-7fb4-40f6-8dab-a722a3660d8f", "value": "768:q3F1U0hKYUVdGV9Bg9uRsZUpMkIYXAn9I6ZDf2QnIjS8NLj35hDUXUIoh+:q3XU0hvUdGV9BgERcUpSYG9192QnuO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651288238, "uuid": "84a81286-e707-48bb-a973-4237e3b3ff2e", "value": 125320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651288238, "uuid": "2cc9cf85-6b66-4c77-a4a5-9ef02ae92b08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651288238, "uuid": "49e9751b-cb9c-43f3-94e0-f88f165f89da", "value": "32c5dd7fe4c02f0e568d2399329287d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c4a3ec-c8b6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651344620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651344620, "uuid": "a845e338-f457-4ce8-933d-915b458e5ca6", "comment": "Malware payload (Mirai)", "value": "5b818ae9526175ee849b1ab2ac5448aa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651344620, "uuid": "7ac6d9e4-10d3-494a-bf53-58e357c07177", "comment": "Malware payload (Mirai)", "value": "73fd6255fc9ee7ccabf94e72ef000e99560506f0afc57693f510b61190826389", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651344620, "uuid": "6f4b1012-ca28-4d1a-a4d6-52b8e8018ef0", "comment": "Malware payload (Mirai)", "value": "4c6410eda303376b77ec35520da009cac0e33591", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651344620, "uuid": "e428126c-302a-4ee3-8cf2-38c701414d8e", "comment": "Malware payload (Mirai)", "value": "6c84a18b4f07e3024b3bcd846874a99366e61b01cd1d08532a8cf5d4c3c31bad1e3279e6ce0945f331a5c78aff6e1578", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651344620, "uuid": "9a5fa55d-e456-4d9d-8fe8-5644dfa246df", "value": "T1AFD2E120D705C1B2FBB81436B2B5C94E32B951B8E36371560C3917679BE7483AAB8516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651344620, "uuid": "b87f4b88-2558-421c-93a7-a027115181eb", "value": "768:zC9n3Z7psGtFcVFBolzw1LPw+CBzzN+1yLKvcZmVwkFBbHzAq+603Uf:zWqMaVFB84shQ1yukZmVvFBbHzAR6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651344620, "uuid": "556bd068-09ae-4598-91b0-21f90b528d1e", "value": 30780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651344620, "uuid": "02aef7b7-81c4-41e2-8174-2f763bb6631e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651344620, "uuid": "93a94b1a-0101-4149-b1b6-3f82cb17df14", "value": "apep.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33313cee-c89d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651333803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651333803, "uuid": "e27a780a-3279-48fb-aa95-f7d902a61583", "comment": "Malware payload (Mirai)", "value": "fc4767dac42ced066d85d0fb3bde79c4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651333803, "uuid": "dcbf94b5-ca89-4b44-a214-73ca4173da2d", "comment": "Malware payload (Mirai)", "value": "743ab6c8bc03a9bef3aede0419a0014c2b443a30b51c698224c5bb88a335179d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651333803, "uuid": "81dd3c45-76cf-4e4f-a285-0ee864f82789", "comment": "Malware payload (Mirai)", "value": "b4e4589495d196ffd38c0b73d006eb1dfb3e6b05", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651333803, "uuid": "1b544002-e046-4a93-bb1c-87e004417f95", "comment": "Malware payload (Mirai)", "value": "f552dd9c7c89b3ee9f1fb332ecf4783ae4c25b00b134f44302920d3a9259e29452993e1fa0e6f2d510b2035b3bda00e4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651333803, "uuid": "187525c6-b469-4cf6-b1c1-3e1da112cdb3", "value": "T1A423021320D7EE03D420847BE9159C697E0449F9B8AD777728011254CD24E63BEF1BBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651333803, "uuid": "f6d28999-b1ad-452d-b1f9-43f7a1baeb01", "value": "768:/K7y1XGO1LCNgukEkvwtqPnH7u83nc0iF/j9q3UELv1Q06pMBwAA3i5R:312O1LCNguovDPH7TcrpiLtQ/pSAy5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651333803, "uuid": "892279de-2118-4acd-b6c0-64cbb94e09bf", "value": 48716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651333803, "uuid": "2be26f44-c914-4d36-ac9d-641d2dea9be1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651333803, "uuid": "aca150a0-6ee5-47de-8d93-c8641e007a1b", "value": "phantom.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a75db4-c869-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1651311524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311524, "uuid": "bf1c71c3-4045-4431-bd4d-25fbfb93580c", "comment": "Malware payload (AveMariaRAT)", "value": "256f48cd76382bd8c37536662454d1bf", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311524, "uuid": "669963fd-1e06-4e7c-9c65-f8cd4b7d89cd", "comment": "Malware payload (AveMariaRAT)", "value": "749de714f38980181de9563f6e37a65cbe4c96fa3c1123a27d8381ddb422820b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311524, "uuid": "4c476fdb-5380-448e-a62b-b82ecded5ea4", "comment": "Malware payload (AveMariaRAT)", "value": "b12afd90ecc56d7aaae0f3492e5bdb235b7036dc", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311524, "uuid": "7093e608-35ac-4cf4-925a-1c5173d7759a", "comment": "Malware payload (AveMariaRAT)", "value": "8dbd19d426633b12ad4d609c13a9b09817d141365f88acf8e973b84c79e4da8e23f3f44320eb77e5a03e4daa800195bc", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651311524, "uuid": "0a55ecd7-a36f-41fe-96e2-fca4a81edef2", "value": "T131E25A832F384413DF828E3995DAE217DEB8B381BDD954BB5426C2412D837E03B6963D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651311524, "uuid": "3e8bbc0d-1806-4d54-bd27-1208349fdf92", "value": "384:fUfPVbS6AnUkHMK2sKI5m9p23+r/jLVqnYPLQRIA9eMHM+NIAQY1Dp23+r/jL:8nMnbHb27zp23+zj5q8zuDp23+zj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651311524, "uuid": "c147e7c7-bc3d-4709-bff6-5e3f2bbaa3a2", "value": 33792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651311524, "uuid": "478d23ae-a705-4481-a888-ef14fce723d1", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651311524, "uuid": "34de619b-272b-420e-9e8c-695c2f219af5", "value": "Invoice submission 7573 PO 133306.tar.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24981a5-c877-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651317803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317803, "uuid": "3efdd879-ce43-4c78-a3ae-ac030f7af358", "comment": "Malware payload", "value": "55f19c84cfc2767a8e61d4901776627b", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317803, "uuid": "f4272967-9a06-4b59-a69c-d116d19d5cab", "comment": "Malware payload", "value": "76b3f9676566041b2c957b1ce970bd50b967e20aeff7eb47b4cafb806e0c7fed", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317803, "uuid": "e55c4fb5-ffaf-472a-a857-061fe9e9961a", "comment": "Malware payload", "value": "3f45e6b0793c131f3b5643631d1a0a34bb223e50", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317803, "uuid": "90f2f02d-6d75-4f46-a0e3-f3e6ad10599d", "comment": "Malware payload", "value": "913f88e2366758c7787528ba3c75c692c2359dbfa9c9514ec8cb6ff0c04234a58e5707038bde78c22cc5cf4010087f0f", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651317803, "uuid": "ad37c6ef-114a-49de-8a44-4f6f04a0b53d", "value": "T1A193F24C84B6CC17D060947BC849CB6B29E8AD57794AFD38D7987A2B3631DA844333BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651317803, "uuid": "d9da05c5-0501-47ad-9f75-c2ba319060f2", "value": "1536:NodFCqYTabJCXddFwAY+6rJFb3fYLzIUK+smLHFaJF570xge8c/DZStdPZkThjzk:NodgDTKMGAY59Fb3fYLzIp+DL254jdCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651317803, "uuid": "e1fddf9b-e3e5-4dee-bb1c-a735d137d9aa", "value": 90181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651317803, "uuid": "a43c5e35-abb6-4300-9f74-75cca0e76572", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651317803, "uuid": "2fa1691e-b601-47a9-97a1-4c8853a9cd53", "value": "STS_5046-2_02_2022-R1.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c7cf59-c82f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651286825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286825, "uuid": "34d367d9-11b1-41fe-8c30-6a2a6d1d7a27", "comment": "Malware payload (Mirai)", "value": "a9be38325b2382a474991cc43d9bd2f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286825, "uuid": "0a4d50d5-bca9-418b-9d96-1523a6c815a0", "comment": "Malware payload (Mirai)", "value": "770fe5cfbea3df1798e7f44bdad135c34f78883df09fbaaf7100e2b2288cc29c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286825, "uuid": "54ffe7f5-1566-4fca-b333-451a51696973", "comment": "Malware payload (Mirai)", "value": "e9f75c45991c053127775ed8cf89f20af5d835c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286825, "uuid": "7f54933b-acf6-4b19-9e3a-f5d40f8c84a0", "comment": "Malware payload (Mirai)", "value": "bf297905c49f8fe4e9eb27d16692141f63d31bee1eeacfe01fcb0143c8ff9d768b223816fed547606e229657b8a466fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651286825, "uuid": "48bef8eb-6fa9-4da9-9b92-477828acff64", "value": "T198732986BC41AA14C6C61677FE1F104E330357ADF2DEB322DD145B607B8B85B0E6B61A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651286825, "uuid": "985add42-6a44-408e-861e-52ebe52cd93e", "value": "1536:TSVn7Goo96wYzXVmY/UFO8tzVMRFy9hD5KTu/LMPi7wrhsK6voX5XL:Tn59sLIY/MhMfitwrhsK605", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651286825, "uuid": "ede95b3a-710e-477b-beee-7cd4d0b4dc0f", "value": 78984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651286825, "uuid": "881a8460-7125-4b8a-9435-7baf0bcb6b23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651286825, "uuid": "eb845fba-934d-45ae-b288-db56208ec4b2", "value": "a9be38325b2382a474991cc43d9bd2f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c4bd92-c862-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651308603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308603, "uuid": "969af680-50dd-4c8a-9761-5f7529825d91", "comment": "Malware payload (Mirai)", "value": "18be814c4caabf4387d17d15cb9d8e60", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308603, "uuid": "4af93048-2393-4a04-a77f-d20cd457ece8", "comment": "Malware payload (Mirai)", "value": "77ac2e2ff33d297daed7f9843eb6f3f1bdefae68a1d4555fae3664b46ac55731", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308603, "uuid": "9c39ffa3-1718-427f-a686-889b8b035571", "comment": "Malware payload (Mirai)", "value": "f2faf6aa1dadae42c9960e867b919a46da2df0f7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308603, "uuid": "08ca2cd6-cc29-4336-bd77-5abd80ad21ca", "comment": "Malware payload (Mirai)", "value": "9a262e3a11f2838054468118c36b8e4bb2377780a3f4802c71dd5e69830e4204bc73da2f8e24a87fd4d83815d045b827", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308603, "uuid": "60704899-56eb-4e17-8aee-9e9d4ef10c27", "value": "T153D2F16536465448F716017A32BE95FB019F4F906FECC80C39FA9167E92F0DC066AACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308603, "uuid": "b6307559-c04c-4b1d-a871-578ee94a433b", "value": "768:2T1Upj4nmwz18Vc+jhsr01jE9i9by53OfQH237ycfa:2T1UB+mwuhsoZLbyxWx37ZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651308603, "uuid": "b1e2788d-8960-4634-8366-37d6bf90df8f", "value": 30212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651308603, "uuid": "1b0af13d-22c4-421b-be1c-d7cde4eb4e81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308603, "uuid": "90807728-b4cf-49a8-9c50-b30637a8b90a", "value": "Tsunami.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f621e77b-c823-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651281732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651281732, "uuid": "3a7c8611-eda9-4fc9-94e5-2e0d672c9331", "comment": "Malware payload (Heodo)", "value": "b61047fdf7f0648823d85ec6a9cb468b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651281732, "uuid": "72114a5e-ad70-4548-8734-f20b80d38399", "comment": "Malware payload (Heodo)", "value": "7834961dffd4ed55c08ae18f359d3e4a699e58abfc6b881d9488f13bec30c24e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651281732, "uuid": "3e797252-446a-4361-add8-3dd9022cc388", "comment": "Malware payload (Heodo)", "value": "35901551c9f00e300d6b11ecdd563842ec31b8c3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651281732, "uuid": "6ef66a45-b1c2-4716-8745-eca2d8bc5e26", "comment": "Malware payload (Heodo)", "value": "575ab9ddbdfe3b3464e7fdb4edf91339a770564aff7cd37c0434bb372c62a4042645464a4a332a3312d092f0edc8da6e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651281732, "uuid": "0f2a3b15-aafd-46b1-8690-cbb79c905a37", "value": "T1D9C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651281732, "uuid": "c2530e85-8430-427e-ac80-2d5172f48682", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651281732, "uuid": "8bd17156-80a0-4b1f-9fd0-f845ab08210c", "value": "6144:JhZ02GdOOgPYpKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfuKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651281732, "uuid": "153b80db-0718-41ec-a874-994322750595", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651281732, "uuid": "3d62d528-12c7-4d5d-92a9-ddfcdfb8e770", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651281732, "uuid": "c8c09baf-7ce5-4745-82a5-755253d7af70", "value": "b61047fdf7f0648823d85ec6a9cb468b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd1919f1-c836-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651289904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289904, "uuid": "fc024f2e-2c8b-4b65-bdbc-c72466e04b72", "comment": "Malware payload (Mirai)", "value": "121d8dadb7e86eec1e84a977fdf6706b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289904, "uuid": "0c9b9da7-37a8-451f-b37f-b37020a59567", "comment": "Malware payload (Mirai)", "value": "79f24fc3a0647b511e00a8b79780ce2a85296e19350bf48163d33faeb6c399e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289904, "uuid": "6082da82-0cf6-4702-8e35-aaddac643a4b", "comment": "Malware payload (Mirai)", "value": "7689fb417a079ba8b21455681483be809a4394ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289904, "uuid": "be7065c5-9acd-4cb6-9931-399e1082a55b", "comment": "Malware payload (Mirai)", "value": "bc06c0d858f2550afa48b0f8d6b0d1a7f67f44368ed4fe2338f9680b48d323fd9c65c34357bfe73a15273ce9e601fddd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289904, "uuid": "dc424f6f-4160-4e5c-9ad3-e0e786c13d29", "value": "T1D9D2E05D9B0412A4DEBA20FC23EB07F21E664FA0A493DD138184B791DE445FC78E7AD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289904, "uuid": "ef4812a1-1bd4-4866-a35b-e6c067e312d4", "value": "768:oyvYLznDEB2iC+sDRmK3rLx2vqqXOJgGlzDpbuR1J5:XYnnDEBI+s1mK3nYkVJu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651289904, "uuid": "e4cea248-c814-43df-9243-91d56a07cdc7", "value": 30848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651289904, "uuid": "5aa4f1be-6cba-449e-b6dc-efe3587fca7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289904, "uuid": "90216f9e-abac-4894-932b-85dc2c11e1a9", "value": "121d8dadb7e86eec1e84a977fdf6706b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1068a435-c86d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651313129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651313129, "uuid": "5e6a0f28-8b09-4a0e-8a92-11c7245059a4", "comment": "Malware payload (AgentTesla)", "value": "04813bb51475f67e2f43c5407444e6b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651313129, "uuid": "730e2405-8db5-4665-be4f-e1f66a3e9bf3", "comment": "Malware payload (AgentTesla)", "value": "7a7d67e18ad21c001eb5d6bf615520590ed095252e6dd20832bed653be671310", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651313129, "uuid": "e8ebc4fe-e53f-4e92-947b-5e945b4cee2a", "comment": "Malware payload (AgentTesla)", "value": "5dbc71cbe4485c3e06f278c4198bb90932d70372", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651313129, "uuid": "bb8f142a-b21a-47ae-b36a-0ba4f5ad6607", "comment": "Malware payload (AgentTesla)", "value": "09362dfe8184d5331c363672a30aff5df6e4c3826a837bf01d5525bc09af39f797cb6f94e0c31e908e1da44874cac245", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651313129, "uuid": "7ec1c0a7-7a3c-4776-b0be-d8f24f925e46", "value": "T154942324F4C04C1720927AA9514E87EFFA9B9D1FC37AD7C3A1721F49483AE7D6B18182", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651313129, "uuid": "26d9838a-469c-409b-8aaa-10a9f28757b8", "value": "12288:uSw8GjWAzeLC9Zk+8ivD7ularKncF68pwhSBbvb/XzAEv:uSw8GjW8eLCeOD7DrhMhSZv7XzAEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651313129, "uuid": "03060a2a-10c4-49fd-b313-e1e0289d1517", "value": 420509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651313129, "uuid": "55ec341b-de46-423a-9de9-efe0bb9fa2bc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651313129, "uuid": "2a208e2b-65cd-4cec-93b7-fe3db6b99472", "value": "SHIPPING VESSEL ADVICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b4c37a-c877-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651317433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317433, "uuid": "07bb7d20-7c0a-458c-a591-89bb1f16dfef", "comment": "Malware payload (AgentTesla)", "value": "87ba794595578ca541988b4cbed1ff4b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317433, "uuid": "0257057f-d617-40ea-b0be-d86212e5d9a8", "comment": "Malware payload (AgentTesla)", "value": "7bce64a453b089804ef2aecf9e764f58decae41235b2a1f378f76d6e1db82915", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317433, "uuid": "bda8a393-bbd4-44b0-a493-0fecef84ca2b", "comment": "Malware payload (AgentTesla)", "value": "b16903c0879c075c7567dc00882b7b55a1c49a8d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317433, "uuid": "eebf8a3d-e6e5-4566-876c-1faa1753e41e", "comment": "Malware payload (AgentTesla)", "value": "4f5252427f3a5ca7471329888c5c7d2a6aa6599263a18864887f70af4c91d3e75c06242fb326a31570cd3965f56ffd60", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651317433, "uuid": "edc8e40e-f2e3-42b7-ac24-da687463a8f7", "value": "T1DC442309FB152467C8B9EE58E4C3150726399081FBB1F506A17AEF4531CBCB7B2DB08A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651317433, "uuid": "02e793e5-56fb-47c2-a1c2-cb204aefeb14", "value": "6144:EnawrIlTDlv8N0l6cWjEajCKTmVTY3J9bUuH03J7izWA:uaykDlEy6LATbVY3J9wW057iqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651317433, "uuid": "fdb84078-bd93-4ad9-abfd-49a804ec4986", "value": 255245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651317433, "uuid": "26734813-6754-41c1-a201-1ed36955cae2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651317433, "uuid": "fdb05513-fa8e-46fe-8787-dd6e7b1dca22", "value": "Documents.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea4cb6f-c868-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651311354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311354, "uuid": "da0e264d-e1ca-4398-9d02-a68c2bf3bce2", "comment": "Malware payload (SnakeKeylogger)", "value": "7f1713ddf0da049b6a8d4b10af85ef80", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311354, "uuid": "218c40c0-c4d1-411c-b9ae-c0b25e1a62ed", "comment": "Malware payload (SnakeKeylogger)", "value": "7c3194a6b703709dfbdb278d73d316e94526464d95c0c04e45256b13e56c1922", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311354, "uuid": "07d35459-0c7e-400f-820c-0125294c62b8", "comment": "Malware payload (SnakeKeylogger)", "value": "b8d286c3185daa885442dac9d9a584390f7af4ec", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311354, "uuid": "e6de0af9-7e19-4ea4-bf34-2f3ec24c17ce", "comment": "Malware payload (SnakeKeylogger)", "value": "b1525a0fdc18abab935d47a38dfc59b5714e17f2df2c33717553ce9846bf84b7de660e5bbf9cdfc0cc83980400bc5e83", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651311354, "uuid": "e201f24b-d360-4377-83b1-c22ad794ba56", "value": "T15D942321593896EEF8AED8C04BBFB7F6470F75ECF08152A6F60B85E01544AB471DA4C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651311354, "uuid": "31e916f6-382a-4eb9-acca-82ffc6c827cd", "value": "12288:dzFeTeoEW1WTJaqSgI4kVFNiR93sa3yUX+5r:FsTvW1aqnIDVFNiR93oUX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651311354, "uuid": "42b7a61a-cdfb-453f-a48a-7cae41b93ee5", "value": 440540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651311354, "uuid": "757600c5-d2ad-4ec0-a353-87063b815cbd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651311354, "uuid": "4665e611-284c-43c3-8f97-7743ea0f5c7a", "value": "Anatawise.pdf.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0b8e22-c86a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651312206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651312206, "uuid": "8073d1b6-d1c1-4078-bfa3-a038d6395181", "comment": "Malware payload (Mirai)", "value": "098008ae835a74ae4392e22af0d4835f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651312206, "uuid": "687805b8-45e3-4ff0-a2ec-5c3a28fa13d1", "comment": "Malware payload (Mirai)", "value": "7e906393275945b5fa6edc0b501216188ad71ed30533d76c050d967cd47e39e0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651312206, "uuid": "b3f2bc31-447e-4d61-8833-98fe99535659", "comment": "Malware payload (Mirai)", "value": "a485abe7fe3041f5a2117554fd8d0df8d5474eb5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651312206, "uuid": "c0de696a-aba4-43c1-afa5-44cad4cacd53", "comment": "Malware payload (Mirai)", "value": "72772730c6f1dce63faa353a431360a9a0aaa46f9976df2ba82806701c6e34daeb3f0ee6ab4b1fede08e182eb25259c9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651312206, "uuid": "51b1283f-95c1-4935-99d8-e65d10694608", "value": "T127F38452E3124566F29D4DF2701A32847F86537AC6FA3183F8164E90FE96C5B05B3EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651312206, "uuid": "18cab25a-8294-4f36-b1b8-5cda0cfea3a5", "value": "1536:2BRKiBJqYsXLlSTo1VisKST+4wnPgj9xCKRDjQrHgxMDWhvWDaheFEVPr8kmvOqA:2BRNBJqYExSSiTcw4j9xCK2ILvcBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651312206, "uuid": "c4e07e7d-bbb9-48bb-a59b-e7eadfb173f6", "value": 160972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651312206, "uuid": "43998dd8-5262-45e9-90ac-c38b7659c89a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651312206, "uuid": "7386cd8c-70b1-4642-9821-819e44c9447a", "value": "garm-20220430-0950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f990e8db-c836-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651289898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289898, "uuid": "63ad54ba-9675-4978-86fe-a2dfcab664df", "comment": "Malware payload (Mirai)", "value": "439fc4b0f054f7020e7cae5949ab6299", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289898, "uuid": "bc430840-e3bc-4d0e-bf52-495dbcd311bd", "comment": "Malware payload (Mirai)", "value": "7eaf1afa52f0806c55fff56a5401d0d7fda4680fd8d3fca6e5a71e803f1177e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289898, "uuid": "06bc948e-bfa4-47e4-80fe-650822e8f4a2", "comment": "Malware payload (Mirai)", "value": "08f5be07c601405824cb4552be8a233fbf7c36b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289898, "uuid": "66a673d2-b4de-45b1-975d-0f8f3e947960", "comment": "Malware payload (Mirai)", "value": "fc86c685b712fcadffa0e60b90d25327d30c0ec80c7ba18d9c4f37f92ce25948918ffcad3f2bba506ed801c97133e178", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289898, "uuid": "18f91fdf-d51f-4321-b3c9-793f9ec00a50", "value": "T132C2F1341420BA60C371093DFFB9C6C567E4C6B8C1A930162A5083FE96DF4C765B7A8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289898, "uuid": "60d88c1d-fdc3-4246-99a0-deea1dcf81ef", "value": "768:xRSa8ZS/L6rze3OXoXpS/zoJjMHlwBs3UozYn:vSjFJXEpS/zoelwszE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651289898, "uuid": "5f4ca50b-bddf-4cbd-9f58-d5d7ae4f0571", "value": 26292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651289898, "uuid": "508b9733-52d5-49e3-9dac-066414b58a1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289898, "uuid": "81680489-e22d-4034-97bf-5bd8dd91dd2c", "value": "439fc4b0f054f7020e7cae5949ab6299", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f85c22-c875-11ec-8e58-42010a9c0032", "comment": "Malware payload (SystemBC)", "timestamp": 1651316621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651316621, "uuid": "f8ed4d21-32a4-48fb-8277-1b2f4585db13", "comment": "Malware payload (SystemBC)", "value": "cfbf1cb96b31132ddbd8074180487b70", "object_relation": "md5", "Tag": [ { "name": "Coroxy", "colour": "#E2C864", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sabsik", "colour": "#6B6779", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651316621, "uuid": "86b4dc38-252c-4693-8123-858e158f4a35", "comment": "Malware payload (SystemBC)", "value": "80748d742c31afee1d1db90ee3c1f3212d48a683482ff0e7f37b721b03001a1b", "object_relation": "sha256", "Tag": [ { "name": "Coroxy", "colour": "#E2C864", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sabsik", "colour": "#6B6779", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651316621, "uuid": "6586a4c2-be58-4615-846a-cde29f6f75f0", "comment": "Malware payload (SystemBC)", "value": "d8cc1b0fcd85365708396cbd8c91a479c5739a2a", "object_relation": "sha1", "Tag": [ { "name": "Coroxy", "colour": "#E2C864", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sabsik", "colour": "#6B6779", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651316621, "uuid": "15992f0e-ceae-42b9-a75f-5e6c326b212d", "comment": "Malware payload (SystemBC)", "value": "3988056ac2869001584f3bfff5e92798a56a074523d0028649064e21723742a5f4171ab21805ea3a7da08990d1e483be", "object_relation": "sha3-384", "Tag": [ { "name": "Coroxy", "colour": "#E2C864", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sabsik", "colour": "#6B6779", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651316621, "uuid": "4062997d-92ba-4ca2-b217-266d9e6cb490", "value": "T13582613E9641059EEB6582F9D5CF8B14C535313B0732E36BA3B05B102E169B7EB60BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651316621, "uuid": "df78fc40-b314-41d5-b8af-9117cdd1f5cd", "value": "bb5490a497d4a5ce59005ca1d1aacc2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651316621, "uuid": "85951197-70fc-4460-96f2-af989abaed1d", "value": "384:L3qHtu750gtxCYLcHtcWajpOnM/uQ9p/mvm12MGSs4:L3Qgk/arfevmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651316621, "uuid": "7299d626-8908-4088-8609-01072dba010f", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651316621, "uuid": "f464f7a6-8d87-412e-a960-0ee231d45f50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651316621, "uuid": "f76852ee-6250-4eff-a525-d5e2d2459ebe", "value": "ss64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b9e3cf-c831-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651287717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651287717, "uuid": "a9dc0d74-603d-487d-8f6c-2830c8b0ddda", "comment": "Malware payload (Heodo)", "value": "f3eb32b4cacf2cf47d76da4b70d8c1af", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651287717, "uuid": "d2162e61-9323-4a34-9ef1-91de36f78921", "comment": "Malware payload (Heodo)", "value": "824088e8e1129ffef409ab15963b6eb7c641a4e8832c7f2c779085df55406229", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651287717, "uuid": "74a8d677-20a6-47ca-b370-3fca9b4f2d6d", "comment": "Malware payload (Heodo)", "value": "010dbd8d62266eb82bf0cc10c8fea5373a1a7498", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651287717, "uuid": "bd968087-8f74-4ae4-b8cb-f7896b26e636", "comment": "Malware payload (Heodo)", "value": "d52347319086345df883d4b1a9948ecca2df9a22c41066e59ba01faf998c6e3598a3731986eefe6c54bf88a4c5922d40", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651287717, "uuid": "1bbacff8-19e7-4475-ac18-faa6971ae5e9", "value": "T17FC4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651287717, "uuid": "0d2f72b2-c5eb-44af-b029-5b4ecf370ac0", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651287717, "uuid": "652b6c49-ff51-476d-9afc-34d746d011f2", "value": "6144:JhZ02GdOOgPYvKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfgKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651287717, "uuid": "9444c534-7be0-4030-993f-7b8f30b231a8", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651287717, "uuid": "dd7f2a74-895c-4e6c-8d1a-6a4ff0429cc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651287717, "uuid": "b987990f-e80e-4137-b65d-22bad7841f65", "value": "f3eb32b4cacf2cf47d76da4b70d8c1af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9898346a-c881-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651321947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651321947, "uuid": "6ea1cd02-c824-4b84-ab4e-5ff5dc8f824a", "comment": "Malware payload (Formbook)", "value": "e3b4c7eb86efcfa099cf462dc6e5520f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651321947, "uuid": "b5bac1ea-79c3-4a24-98da-d0bddfc4d9c2", "comment": "Malware payload (Formbook)", "value": "83c57d2c56322d94de9d5488f39c49a39602883694a46f2cae26468e030bec96", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651321947, "uuid": "0816a46b-d465-4b4e-8e53-9f5b11ab0dea", "comment": "Malware payload (Formbook)", "value": "0baa23bc41d3054ea824063fd1f93e6af8fc3ae1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651321947, "uuid": "2f6c918f-3224-4b68-a83d-0605b398f4db", "comment": "Malware payload (Formbook)", "value": "d148aa64da205621b4557d07b0618a16819148acf99e1da961589b54f66299e0787d4b4b082a1c2087bc04225a9ed77c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651321947, "uuid": "01d469e2-55b6-43df-884f-b77da4b7dfdf", "value": "T10CA2BF30AA1FD80DD1A9D576109F31B4EDA06087DB779E0F586C605D8E72A9E0307F79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651321947, "uuid": "30ec4cdb-4b95-4291-81fb-45c4e1e19e32", "value": "384:zXSKgETbqb0HHHHHBHlDYIBSjyFvLF+N/K5w70wsKKWhaKSKiJgkuZVsqxfWXhXp:zbZ2b0HHHHHBHHSjypINy5iLOKe6Vsq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651321947, "uuid": "838e183b-d9b8-4ff3-9f47-6ac8d556203e", "value": 21868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651321947, "uuid": "b1410d70-95e6-4446-bd85-7886c98572f3", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651321947, "uuid": "fd13000c-8732-4175-ad44-39e55119ac2b", "value": "Order Confirmation.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca854e22-c8a9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651339211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651339211, "uuid": "c4ef69d8-0be1-4bea-aa1e-a003e5908697", "comment": "Malware payload", "value": "a96cd130892abee52f47d58e3f53c37d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651339211, "uuid": "83e0eb98-6863-45e1-bee3-3cbf74069bb7", "comment": "Malware payload", "value": "8558076dc92c9221c719bc1aee40a068f1d9c6077f9225c58691b50489ff559c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651339211, "uuid": "3799aac8-448f-45a5-9631-f27ef894ef9e", "comment": "Malware payload", "value": "a06043a57411543b457e564312404547dcd230cc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651339211, "uuid": "da0af06d-8c07-4ba7-8b64-c29eb43c951c", "comment": "Malware payload", "value": "7f5c4cf21863a846a6b317eea94d2292ae6e68dd89379f09b3f2ae27795dcf5f9f40e68c1f99b8897b652f5828110189", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651339211, "uuid": "570878f9-ccfc-4875-a969-b58fc52bc8f0", "value": "T11F058D4AE6AC80B2D076913CC553AB4BE3B57C504B64938B43A1F7BE1F737A15D2A312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651339211, "uuid": "685ccc2e-c7fb-4859-b26b-02a4825df56a", "value": "197d9b9439eab515b09edee36544d57b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651339211, "uuid": "0e008e90-1a4a-485a-878e-d408c3d49bc0", "value": "12288:VMeQsno2LR+eTz4kMJFGH6C7Fj73Whmrkj5S3u49aP+Q6JC3s5cYL:VDftXegvN7WhmIj5OuuNQAcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651339211, "uuid": "4800208a-a4da-49c2-8a32-3ed2ab57093b", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651339211, "uuid": "00336524-73d0-4fd6-989a-b3c103e0efe9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651339211, "uuid": "ca509d98-dbf4-4d5a-b734-3f96a09877be", "value": "emotet_exe_e5_5f6cb3541561b7de86b17525b418e3ae49fedaa7ad81b9014ee83042f2772782_2022-04-30__172005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd93c96-c864-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651309585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651309585, "uuid": "17a58037-0525-4904-b9c3-fe7403927fa6", "comment": "Malware payload (Mirai)", "value": "f55165d4b62d6f5f88f98036f5823a58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651309585, "uuid": "b6c04adf-7d0c-4390-a6e5-e3782c3690f7", "comment": "Malware payload (Mirai)", "value": "863bb641bcf8573934c806494e84323a4fda4a4b3389c64d67bbd6894dc3cd0a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651309585, "uuid": "7b0d157e-a0b2-49b0-9705-4741069d4f12", "comment": "Malware payload (Mirai)", "value": "97835943a1f938b4cee79167ba707cc8ba0d82f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651309585, "uuid": "1aff7f7f-36dc-4e6b-b149-a113fc6c8bb7", "comment": "Malware payload (Mirai)", "value": "9ae3c6b1ed1fb9689e4e1f31011be1ce1b34b697e7a2b268d09b939197acddac7835023b21e3b60a1c4865fcb249b0eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651309585, "uuid": "e42a0f96-a920-4810-a554-5fea9f492715", "value": "T13BD2E158F64429F3EF6D5F79DC97C50A3B8B06B2FB415E7070989F50AA112319A01CE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651309585, "uuid": "2366de64-2371-4a09-a11f-7a2299ac5eb3", "value": "768:p7bcaE7eQvHRujP2rIZD4CFTwWgY1uXQGWJ/vFrGIJ4uVcqgw09Me:VAarsRuj+ENtLgY1XHT4u+qgw09/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651309585, "uuid": "bd0ebcd2-1145-4acd-b7fb-68850634b221", "value": 29364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651309585, "uuid": "8845805a-e23e-4b9b-9719-8aaad20acc38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651309585, "uuid": "44344637-e5c0-41f2-97d4-ae3cfed04585", "value": "f55165d4b62d6f5f88f98036f5823a58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c057d7-c836-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651289859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289859, "uuid": "71038d79-62f2-4f6d-a5bf-e24bcaeb4ab5", "comment": "Malware payload (Mirai)", "value": "dd98f76e51379ae86f213d368e353afa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289859, "uuid": "d9fcfe94-8e15-4165-ac91-f0453adc35d8", "comment": "Malware payload (Mirai)", "value": "882ebf514903f99b4353fc895a3948c6b2b9578b9c90b16b512706a868300301", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289859, "uuid": "d244482f-ed55-4b9a-a4a3-8c6626037937", "comment": "Malware payload (Mirai)", "value": "be8713de676a4026aeaff11a7410d384506ed059", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289859, "uuid": "dd50bb6a-9369-41d5-9b21-f02461e1e9f7", "comment": "Malware payload (Mirai)", "value": "0d6a707383d62e96cbe1d59dd651de0a5f6d7b010f58bd0d02ba178a94f59db3b3ef91a1fe98f071a4cbe1bbb3261690", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289859, "uuid": "42b7933e-783c-4dbd-b31e-61e2fd4b75aa", "value": "T174E2F2DE76C028B5DD6E943C63CD25A85A8B7542632CDF849B7249C8665DCAEFC8C03C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289859, "uuid": "06c0f3f8-2a03-40f2-b0a3-384ffe6e6402", "value": "768:nfpWceh4wsfWjDnF9XkGEsrNQL6ha3LWr:nfkcGsfWHFFTJha3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651289859, "uuid": "54f950c7-0a78-4dcb-a5f5-bf05d5a1ee46", "value": 31960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651289859, "uuid": "3712fbf0-3315-47ce-93a2-28dd4584bd32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289859, "uuid": "5bc9dce2-3def-4138-9043-c52720d477b2", "value": "dd98f76e51379ae86f213d368e353afa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f6de8b-c853-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651302047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302047, "uuid": "be336fda-c067-423f-b31c-ff9cf908091b", "comment": "Malware payload", "value": "9d1f1f924c39e51af4bf07c70a3cf1b0", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302047, "uuid": "ce861ac4-f986-438b-ae63-a3fce5863006", "comment": "Malware payload", "value": "88969adb1ff0cbfc7635f7740299a3f23b74c081cfbafd21ca588c75b369860b", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302047, "uuid": "0c908f64-7641-4443-b174-662eb3831f68", "comment": "Malware payload", "value": "6784bcdea24807098fc973cf36eef78850a081c3", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302047, "uuid": "72bb2ff6-6fb4-45c2-9150-a33f178bc842", "comment": "Malware payload", "value": "05cbe05e005a4ae674bcbee3ef358e6813af5fbaa6687e08f899f047ed9e37e5c6755dbe46b774f84536c446ca736b29", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651302047, "uuid": "a9116444-138d-489b-ad6b-404c103f170a", "value": "T11221210607F41785E2368E356D3BB340D771B5269E2BDF2D4484DB886DB1A08F53AA27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651302047, "uuid": "bb3fc280-ccb2-4276-b5ad-dfef3b0a2e21", "value": "24:8NUvCXdreJ8lTyAJex+/Cll6o0aMZDUZrWBpAXD/zusmv:8NV5eJ8lt4LlooIBqXjzus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651302047, "uuid": "35387ffb-8a6b-4b48-a069-51d6cf56c409", "value": 1195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651302047, "uuid": "020a99a0-c6a3-4b40-858a-9091389c1321", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651302047, "uuid": "db937e74-b435-4929-a20e-2d2b83d1a0eb", "value": "documents.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ac368a-c825-11ec-8e58-42010a9c0032", "comment": "Malware payload (ZeuS)", "timestamp": 1651282506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651282506, "uuid": "50e2d284-ac43-40c1-81d1-bec13f82e8c7", "comment": "Malware payload (ZeuS)", "value": "4ac23a9816b1abaede4b215a240533e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651282506, "uuid": "9084df3e-98b2-4a77-b61a-2098b741caae", "comment": "Malware payload (ZeuS)", "value": "88c9bd2ec09ddec7b103660c9dd8b3afc2c72ecc469bd327106c598e1f58a520", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651282506, "uuid": "0a12a201-677d-4039-ae66-79faf69113a3", "comment": "Malware payload (ZeuS)", "value": "6efb25548b8601e45637b7f7761e50cb0f601f7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651282506, "uuid": "c664cfe5-ec79-4820-8f6c-ca6de1fa5757", "comment": "Malware payload (ZeuS)", "value": "d7041ffbd09805295a314ba7278f691ece45c41c31311eb8b602758d49a60dedf1754917d24a20180412a68fad7643bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651282506, "uuid": "ddc3a2dd-074a-4634-b1b9-76b104936654", "value": "T104134B85719C4EB3D0E62E721420DB238BD5E4A24A3BBE31CFD26AE70B55553B40B6C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651282506, "uuid": "bed12225-c5f0-4d64-897a-7d919d864160", "value": "17a4bd9c95f2898add97f309fc6f9bcd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651282506, "uuid": "6d1c7b91-518f-4789-ae89-14c148d331dd", "value": "768:mCB6QPXYVI4mc7LsCtFysRpOE3hEj8BrDtA8E8V2YK:TBaI4xZtppOJEXPHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651282506, "uuid": "83c926b9-1429-4f17-a61d-65435bfe1a1c", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651282506, "uuid": "a9fa2c60-f1d2-4a0d-b77d-9096dc7fbd17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651282506, "uuid": "5b0aecdf-30d6-4c04-b962-7762342b9d90", "value": "88c9bd2ec09ddec7b103660c9dd8b3afc2c72ecc469bd327106c598e1f58a520.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d172b2c-c880-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651321337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651321337, "uuid": "3190b98f-b80d-4746-93ac-6e0998938f7d", "comment": "Malware payload (AgentTesla)", "value": "476b377a2251a3365a33d2b8c8f8a8b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651321337, "uuid": "daf5ba12-6c18-4dba-b4f7-52a1b1f71327", "comment": "Malware payload (AgentTesla)", "value": "8b61980fe9d9a8fc327cd95cf9febd002c60786fca9ec98aec6f6d279d6aefc2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651321337, "uuid": "13e2df0c-82ad-4752-b051-3f5550488211", "comment": "Malware payload (AgentTesla)", "value": "c28a613d74388b818d44b6b8ed5df1e110ad7c44", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651321337, "uuid": "4740e0cc-331c-4add-94e5-88fde4d06ccb", "comment": "Malware payload (AgentTesla)", "value": "637c4f819bdaabf64060c6d377e2d5760e04c393539ebe469b9bfd3f6ef5504d5be6b9e0f0b5560d65b6bf78466c6189", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651321337, "uuid": "ba8cd616-fc76-440e-adb4-707e4027c897", "value": "T1E3B42358A73A4D7DA280C1E3219819E6C47615DADF1DA41EBACC6C7F3A237C4F51888F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651321337, "uuid": "dd2ddd8f-f6c9-4477-8107-7d5ad1c99605", "value": "12288:a7/e/Wk9gWyI6AFY0tMd9vGRgRjfvfmrrE7U:S/kWKgeNFGRmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651321337, "uuid": "c8d50f17-5478-4b34-8eb1-d3ddd19f6f74", "value": 529322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651321337, "uuid": "2a6a424c-fd33-4bd5-8e63-1f0a3f99b246", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651321337, "uuid": "c317e66d-1df2-4d12-bb9e-71e21a514231", "value": "BL. NO. AWSMUNDAR360621.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57aebfd-c875-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651316922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651316922, "uuid": "b1277285-509c-4888-848c-e9bce1447481", "comment": "Malware payload", "value": "0f9503e2ab3aa47d6e68f5f15a768a89", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651316922, "uuid": "4af3c9d7-11cf-4b4c-9ffb-e0f74e7fd324", "comment": "Malware payload", "value": "8c6745d7b0121ed4fc5e6d929ed564e3c7d135fe60801015dc01ba948cf14197", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651316922, "uuid": "5644c97e-36f9-4894-bdb8-b05399e0399a", "comment": "Malware payload", "value": "6fafabdfb6ae3a746b2053cbc4780b10c5a413a0", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651316922, "uuid": "7d895daf-664f-4d2a-8847-8b24cb86fe24", "comment": "Malware payload", "value": "b996a8f1f15d425e70540c82ddb4fafbce5c5c5bbaa1dbcca5674263f81917955b497194a3cbda71ba65e523c61a8b23", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651316922, "uuid": "4715f634-1430-43b9-a2e0-f9e06cec5773", "value": "T1F162E1F41764DDE126E320C4950D9A6E5A496ED83B4A2B1FEB3DC717A2C29283D4873C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651316922, "uuid": "f731d3ae-a6bd-490b-8f0b-083c1367cf3e", "value": "384:vkzRwcYiDLxEbs9f6QSFGQxsbQCsJu6QVwf:4Rw+FZ9nSgjzsv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651316922, "uuid": "2a1a1aa7-7b83-4366-aa62-b3103acda460", "value": 15173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651316922, "uuid": "30f4b103-4002-474f-b1e7-c82437305ecc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651316922, "uuid": "945d3fcf-4a06-4b69-8306-d51d76c35785", "value": "2022-03 E-CATALOG.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42df7878-c8b6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651344567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651344567, "uuid": "5fc49cb5-70e2-459e-91d5-2a358c13c2b2", "comment": "Malware payload", "value": "3b234edee8eb312a39a7242ab3ed6231", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651344567, "uuid": "d4dd18bd-c8a5-4d5c-91c0-7d31d377246e", "comment": "Malware payload", "value": "8cc8900b9a835d87ac881c643c8974649144295f91f1e02dcc11996703f5edf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651344567, "uuid": "c4c3a7c4-74f9-4bf3-854b-bcd7648096b2", "comment": "Malware payload", "value": "677261f0086402b648f24b150a80547ecd2481a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651344567, "uuid": "c3b7dead-010f-4110-bf2a-5dacd258d533", "comment": "Malware payload", "value": "2c7424e6aa6d0ee16d241ff88e7d76967e199ebd7ba9c9419b68be42e6467c8a2fa51dbf8c03fd16e566611c92bb5ac0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651344567, "uuid": "18ca48d0-7013-4dfb-b69a-a7176e3f074a", "value": "T144A45BE0324D9BD3DD369A36169F8E7013E359228221F737ABC777F6261291BD913281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651344567, "uuid": "bed2541f-e32f-4d44-bc61-c7ea355abd19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651344567, "uuid": "be19758e-c958-445a-b38a-fab7cf1ee33a", "value": "12288:cE8jf4LkjrN8G7t9DsSfN27pll0oyr5JVJK:hO2GHD5127Llt2fJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651344567, "uuid": "11f99499-83d2-4e8e-a8da-d4610750fd43", "value": 452096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651344567, "uuid": "74108c8e-5478-4092-9992-e6df8a996a69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651344567, "uuid": "97d56acc-74a5-4c6f-907b-9887166f2303", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53b1d8b-c836-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651289890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289890, "uuid": "62b960d4-7ba3-4104-b44f-5836a4d52ffb", "comment": "Malware payload (Mirai)", "value": "64e4b700b3cbc061facecf46355966d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289890, "uuid": "22b78879-37ee-4da3-86f9-e7c45d73cdc2", "comment": "Malware payload (Mirai)", "value": "8f3ce078a3bc7b853f78d01cd63101d727894df609c27a2d92663c6ea87728bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289890, "uuid": "d0b1eb5c-1455-4f11-953c-9c6b83a1efc4", "comment": "Malware payload (Mirai)", "value": "51557faf73a05812e7929f4ea6b7e4750043df24", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289890, "uuid": "5a79218a-bb41-47d5-8669-67c72f6040b7", "comment": "Malware payload (Mirai)", "value": "373b1b47cd6f0c4d59415d2a6bb9463d859c88365373a3b731266d4792946cbcc972a4db3b6f3de36af2a6324a740acc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289890, "uuid": "897cb9ee-f605-405f-b763-2e21cf190217", "value": "T1B6332A8A64112E6DE9DA5CB981764F0ACE541210B093171FB3BBFDC33933368FE66949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289890, "uuid": "4588d805-6356-4242-a479-b9ef05039dd3", "value": "768:UaRTre1lS2oueg2me2nPQCHEM/ArPwqLWDG2TqOhRol7gSu9+f1prZadI70eNia:Ua0zoRg2mew4ChAVLPF7gSyg1pVa6qa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651289890, "uuid": "c4352244-55b9-432d-b14a-ad94a3c56036", "value": 52820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651289890, "uuid": "b56f20df-b681-45ef-9398-b2a1eed06155", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289890, "uuid": "58daf785-b72d-44c0-897d-1f3c0a26a8be", "value": "64e4b700b3cbc061facecf46355966d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12fa1986-c87f-11ec-8e58-42010a9c0032", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1651320864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651320864, "uuid": "a36cd4ff-2521-4706-b36f-0204d033c064", "comment": "Malware payload (YellowCockatoo)", "value": "e6679a4c9fe310fea422e22aaade7c93", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651320864, "uuid": "7393cd13-13e8-4846-9923-0256d5d88a47", "comment": "Malware payload (YellowCockatoo)", "value": "9039b8a126bd77489059e05ff83d1d6bd62bcc1e9cffe1d59227ab26cf447b61", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651320864, "uuid": "d18a570b-4eb3-4e70-9b61-a3a4a8dcc818", "comment": "Malware payload (YellowCockatoo)", "value": "007f82c160d9bf090e6f41e1f24051b69322620a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651320864, "uuid": "5ce4c7e6-b3f9-453d-8176-3376a0c527bc", "comment": "Malware payload (YellowCockatoo)", "value": "754a440b08a822a775e36461b790ae239e2a0faf212274bf3837c709f49dede6b1d0df7e52c0af3a20bb03405243615a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651320864, "uuid": "00b8150a-8119-4e32-ad07-d578e3b3a7b2", "value": "T1EED46820379FDD6DDB2C16E9739B2324872060FFC5B28F8E69A150B5CA19A647D0C6F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651320864, "uuid": "939afa6e-f147-4228-a76c-cad8a04d94ec", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651320864, "uuid": "b4b59c42-f8b2-40e0-a91e-af334a8003b7", "value": "12288:WBVACCWdY/KvzArEh/ScafG0S4Jrz806euv:GFW+GEM/Jkdeu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651320864, "uuid": "d15c44fc-8139-4afc-92b4-b6970109edf9", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651320864, "uuid": "181e6ae2-99b2-47da-b0e4-0987287fd9b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651320864, "uuid": "b5c151e5-c932-4e1f-b46d-fed7d8833cda", "value": "solarmarker4302022.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b10dfc-c8b1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651342389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651342389, "uuid": "143403b0-b98d-4b8f-b18b-a2b4f90452fe", "comment": "Malware payload", "value": "69fdad45b5cfa9865b19785beb6d62a4", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651342389, "uuid": "d52a93b2-eecb-460a-87e1-ef85df7e83b4", "comment": "Malware payload", "value": "917db9b510f729733aadf8d3f233726e645e8d0761fc6289f7cf5d205bbe6aea", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651342389, "uuid": "9589405b-365a-402d-bdb6-e7e3fad78f4c", "comment": "Malware payload", "value": "1569dd7bc5c5edb959d18f062a0f5a36987c4e8a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651342389, "uuid": "00cec54d-70dc-45d3-973d-2583c41c6be3", "comment": "Malware payload", "value": "983935fd68a64ae8ebf59da4e795322a8c4c076c3f2b87599a7bbc9b55eeb816ec9ff477c302e2c08720a817bc78d022", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651342389, "uuid": "00e5cfaa-b083-4095-9436-430b83efe950", "value": "T1213512A37EE6D07DD2D35270A65CC873653C21CAA40CA23737B4AC46187AD691F13EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651342389, "uuid": "b8779129-78f2-446e-922f-07538017cfc6", "value": "24576:G9yGcmiaez8hAYd/bVpIyjjGWKuhZRzaf0Y+yLYwQuYNHDiGL3oJqPfJ+:oBiaeYhfd/bVbjaW4B+5u0P3TP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651342389, "uuid": "35dce621-62bb-4ed6-9a7b-89831f0f6598", "value": 1105595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651342389, "uuid": "e9fbb251-e2f2-4f8a-96db-a9c688e667e0", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651342389, "uuid": "bdc5a59b-9730-489a-b8dc-22a767675d5d", "value": "launcher-1_0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00fa0038-c8bb-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651346604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651346604, "uuid": "2a416681-fb33-436d-9c4c-64cb0c4ceba3", "comment": "Malware payload (SnakeKeylogger)", "value": "49b85e022397fa8d82e0507da2759116", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651346604, "uuid": "555a66a0-f600-4ad9-a95a-68be55cdaa5b", "comment": "Malware payload (SnakeKeylogger)", "value": "920250bb329fcd3b5fee8a64ffa7c3df7c069c2260d0f7444984e9ab56c84527", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651346604, "uuid": "f3f2aa2b-7864-44ff-ba15-bec6d6c76210", "comment": "Malware payload (SnakeKeylogger)", "value": "fac578494cdbc1df37802cb4a30ca273cd16d220", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651346604, "uuid": "9535b6f9-b145-43db-ae46-b3e13df008d8", "comment": "Malware payload (SnakeKeylogger)", "value": "525f2bb09b9a8dcd526baa5a06d187f5b9dd27698da6835142b408a45b0c85ba02574fc600f7552a6a7f6e4bcfb2b6f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651346604, "uuid": "08e88121-96e5-4a89-b6c7-7661cde1574f", "value": "T193945AE0324C9BD3CD769A36069BCE7013E359228221F737ABC3B7F6265291BD553281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651346604, "uuid": "6a84824a-9d34-494d-873c-b9658bc93f7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651346604, "uuid": "3f9b8885-acb3-4823-a497-5af798d380f0", "value": "12288:KwAxHEV47l1G7tw2Bts2EUbziVrPuVT3itRLw3:veGmqts2RKVSZitR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651346604, "uuid": "74c439db-c6d9-490b-a0f2-11d91e47ad5b", "value": 439808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651346604, "uuid": "c5d120d2-8c64-4999-b47c-87cf6c6101fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651346604, "uuid": "a9d232c3-acee-4e11-9888-a53ca2e96bae", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02480950-c870-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1651314394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651314394, "uuid": "14390535-8ba7-4bbf-b4b5-b2a050b88059", "comment": "Malware payload (AveMariaRAT)", "value": "cf65cae85911a8ae612ba877afd186df", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651314394, "uuid": "38764026-31ff-4a7b-a109-861a9d41c103", "comment": "Malware payload (AveMariaRAT)", "value": "930f1012066a26b62b9480c38dbfab7baa13255df7b7a167b0a2609f36ef630f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651314394, "uuid": "8878b26f-9212-44f8-a890-a0dd2f8561a0", "comment": "Malware payload (AveMariaRAT)", "value": "0ae1838877076d10f4c36c830c2fc319419744ed", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651314394, "uuid": "b66d2fe0-9e80-490d-aec0-373e72e5557c", "comment": "Malware payload (AveMariaRAT)", "value": "80faf52c6185a3c21cb169e2e0c07bbd730e20d905ae8b44b7e44a9897e6c40b7f8fcf7451db7d6f6c3e7ee86f06b0a5", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651314394, "uuid": "3141313a-9f52-4347-9489-3da88e13bd4b", "value": "T1C3441274C27CA2FCD384D9FAABEDB854F44985CCDD90A9A09454F6EF2E2203E161DC48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651314394, "uuid": "957ae09c-9171-4eb6-aece-764cdedc14e0", "value": "6144:i9y1Wg3uIb/vLSHomtJ0FrLDH6xavV04RcBSNJ9NSNjNINAk:i9jg3RDTItsLDHb+4RKSL9IBSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651314394, "uuid": "b29f8f81-0a86-4780-9ce0-9571b736bd11", "value": 267667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651314394, "uuid": "2d74a40c-fe08-4e28-ba61-07006e37db28", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651314394, "uuid": "0075aef3-d476-4bf1-96f7-456fbab42a68", "value": "BrixtonLLC_PaymentIntructions.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c365ee-c89a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651332678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651332678, "uuid": "33a2867b-2466-4b7e-909f-f362c9fcdf49", "comment": "Malware payload (Mirai)", "value": "c42ed626b530098f3e809cfa7313769c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651332678, "uuid": "a0d697d6-9778-4300-a626-8d16fa434007", "comment": "Malware payload (Mirai)", "value": "93e76a97a0fae53713860d41a9d001a8ef73a88811382927086292af513702e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651332678, "uuid": "10137df7-e308-4beb-b39f-40ecaa3ca219", "comment": "Malware payload (Mirai)", "value": "a58c1182276244b6021357f5c3958f46cfc33238", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651332678, "uuid": "580e0578-e79f-4c9c-bb18-ec6c85bdb8b4", "comment": "Malware payload (Mirai)", "value": "889082474b9a1d166406c8cdcff7d6dff0de40665ac2afd4760bdf03c9edce4aabab8d698410d4c41bfefb52e8971609", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651332678, "uuid": "2036e49d-1890-488d-97a2-558f6a362be1", "value": "T14B3339DBB4029E3EF48BE67A405A4D0AF53122C11193172373BBFD93FE32154A952E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651332678, "uuid": "cd94d9d8-6f55-4bbe-ba21-88a7dd65db9e", "value": "768:jvSPF+B0oMokuRdQxbpN/gFHKYHAEuR8L8v8b97oVkfXKBfvob40:j660q6+FNHANR8L26oVkfaBfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651332678, "uuid": "2e457741-321d-487a-a6de-ccfef6adc175", "value": 53544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651332678, "uuid": "190968b0-75d0-437b-ac4b-970a6f562289", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651332678, "uuid": "ba0881b3-6d45-46b6-8c4f-ac23d787cc1d", "value": "c42ed626b530098f3e809cfa7313769c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5206585a-c86c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651312809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651312809, "uuid": "cc3e5211-fe68-48fa-93a1-f6c07bb297f8", "comment": "Malware payload (Formbook)", "value": "17e5e4594d690887b71ede0d168f4758", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651312809, "uuid": "dd85d8cd-dfa4-4b3f-ad3a-1e59bb97e259", "comment": "Malware payload (Formbook)", "value": "965237a0b93b0b13aefda105de263f0b24652a94eb32ce29016848278349c4c2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651312809, "uuid": "5cd3a18d-753c-4900-9a10-cfe5a6b32666", "comment": "Malware payload (Formbook)", "value": "b35a068ac065ef17d33f7ae78acea2a65b89344f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651312809, "uuid": "0c81be74-fa41-4719-9665-3ea56a8e9f6d", "comment": "Malware payload (Formbook)", "value": "c8429a95fa521934b581fd2298e347e968f973581fba12b91d33052cc5e27354d55239bc5ee5f0772c38abed262aca46", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651312809, "uuid": "57a1ee26-0cab-457a-9462-acd7c96abcd6", "value": "T12B52D00E97248BB548D27620055A21DFB04F4D4DE6B6529F17E62887182A20F59BCADE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651312809, "uuid": "4752dff7-9d32-4e83-9527-870843d615c1", "value": "384:r99U1iEQ6nVNYQ4lj6MOt/2LKdAA3J71GO:rINQQJ4lJOtuAZxGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651312809, "uuid": "30d317ce-8001-491e-80f8-4f448529d7ff", "value": 14118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651312809, "uuid": "336c35df-2cdf-46dd-aaa2-51b846c9e0a8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651312809, "uuid": "deba5fc5-d742-48e0-a9d7-38d69ca9db67", "value": "NEW INQUIRY.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4abaf83e-c873-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651315804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651315804, "uuid": "6e1194a5-aed3-48c6-ac02-e60eaa73a1fa", "comment": "Malware payload (Mirai)", "value": "efb6cdc9341f795fc67fe470def38e04", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651315804, "uuid": "20962131-26f9-4e60-8411-d57b43e9c4fe", "comment": "Malware payload (Mirai)", "value": "966df524bda97cd75b427c55bcebca1e786fc68d3b597b16c4c97b5b25396cce", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651315804, "uuid": "c0a84e99-6cbd-4203-b7c7-c9fe18d75c50", "comment": "Malware payload (Mirai)", "value": "5b444fe18dc0ecbdd8b7ae6e6f5cd18316626d1c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651315804, "uuid": "60960f21-d9aa-4f33-903e-537ea530d8d1", "comment": "Malware payload (Mirai)", "value": "b9c117e1423c25a955335513ba7e2a4547fd55af6fa2285c7e3925bfe8f6673af58a71bf5e25fbd1ab71aa0a32443454", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651315804, "uuid": "66a034ad-58d5-4667-bc58-6e3dce21093a", "value": "T10D23F151860A4BB0CA216C72EC8E1786F76D5D6CF1CEB4076094B20973BB7AD8B59C47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651315804, "uuid": "63d6b39c-dd4d-4c87-9dc2-6725c1c314f3", "value": "768:M5lpPa7wNgUTbj3mMrxxjbSRGIAisFapQfMovLB9q3UELUyTQPvfaYvDIqmDRrF:MJPa7+THHxxyRGXz8L20LzQPvDvKJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651315804, "uuid": "09dc5431-27bd-45a8-ba1e-d47f3b5b2200", "value": 49004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651315804, "uuid": "29740f9a-773d-4546-a1d9-c25eb68deb76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651315804, "uuid": "a223072c-c26b-4758-8900-158d7d95a2d0", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e239c0a-c868-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651311058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311058, "uuid": "12bc08fb-1e8a-413f-9057-8266185c7996", "comment": "Malware payload (AgentTesla)", "value": "953aacd144a8408c62535ac3abefb409", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311058, "uuid": "a27ac88a-76da-437c-9573-850843fb4b41", "comment": "Malware payload (AgentTesla)", "value": "9a03c30814017ba26cbea6e0db1a9fb00a10a737a42a40fe0ddb11744558d03b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311058, "uuid": "1ce3995b-b2c9-4ded-b00d-b28972902ea7", "comment": "Malware payload (AgentTesla)", "value": "3b6daaeedf3e64e93a9aee4948f64a2b1ae4ed6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311058, "uuid": "38a10a58-de72-4a3a-9ada-37e5ed9d1a26", "comment": "Malware payload (AgentTesla)", "value": "f4fae421540d8c20ef6073542da4148f248dc33b31b4975f53b48ce37b0e52ee86c40e0bc1582f470a40fa765f43456e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651311058, "uuid": "fae77d1a-9209-4fb7-8d87-b87dfafa0f6c", "value": "T1899433751112C79768626B78F58292E182B4CFD16FCF67E109B65E31D0CC2273B899E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651311058, "uuid": "b10076d7-eae1-4286-82d4-ccc7d870dcbf", "value": "12288:JchUyHgleGJSI8e7a9PTYy0WUs61wrGm8dujAlHTz:JkUwgVSI8e7a9PTYyJ6iiHlHTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651311058, "uuid": "b1b6c7bb-8cef-473e-8685-f47038cd9c41", "value": 428962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651311058, "uuid": "5b325cb0-ec6b-40eb-8bc4-eec1442742de", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651311058, "uuid": "13577811-bfba-4f32-ba5f-594845d48823", "value": "Invoice 0125649.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f9d2cd4-c877-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651317637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317637, "uuid": "8440335a-8ef6-4b2e-9423-aa8b41bfc69a", "comment": "Malware payload (Formbook)", "value": "e98b340564d73c6dcb3194fb0f7919f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317637, "uuid": "e6ba430b-e171-4ee5-8623-7283d05d49be", "comment": "Malware payload (Formbook)", "value": "9d424d6a5f9b3fa0659de083cbbd59087e0a31d794b80451aecc96383f153ae8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317637, "uuid": "64b783be-7d4f-4417-ac80-760b1523f71c", "comment": "Malware payload (Formbook)", "value": "774dacee79c3386ca73fb8440dffdf12febc73a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317637, "uuid": "f0c3f5d5-2973-4286-8b9b-29641add23f0", "comment": "Malware payload (Formbook)", "value": "a2191918c6813969ad688a9b4debedbc99c08fbf6b87748032c7e179662e9dc36965764f0764c08ad58710bc8f44f3b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651317637, "uuid": "c519ecde-e8cb-4d73-839c-02982233c9a5", "value": "T1B1B4020837ED8B63D6FD87FDE026861627746606A263D74D2BD970EC2DB73610A01B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651317637, "uuid": "c102e826-1d19-4e1d-9d68-7a609bbb28fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651317637, "uuid": "6f70be6c-cb78-4b80-a132-19e7dd631047", "value": "12288:9y3p6fJhHTmgpoKo0snRiJAAeRIkMF7oVLEQuoI:IpY5iKoKo0+RiGNIHqEQV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651317637, "uuid": "1e62ac49-0195-4bea-a6b8-78e5a6c18561", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651317637, "uuid": "23f0bf77-5690-4b65-9c88-568e05e2c011", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651317637, "uuid": "4ed5fe31-0040-4eb3-8d26-1ef655695506", "value": "5544682.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3cbbce-c862-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651308617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308617, "uuid": "f33df03c-0b8a-4f61-b945-5bb1310cc716", "comment": "Malware payload (Mirai)", "value": "bd1dd60d4536118a641044f7675d6708", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308617, "uuid": "b4f7986f-f0a4-4e18-89de-fc3ecdd9dfe7", "comment": "Malware payload (Mirai)", "value": "9e42b5aa1110ea880e1e6c37d5c64aec9a8b8fe0ccd3f954d099f0648484a27b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308617, "uuid": "1a12fe7d-7402-47be-be27-b35b836680c8", "comment": "Malware payload (Mirai)", "value": "cda4ef9c8aa66c3ace5fb9134dc7beacb397fb3d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308617, "uuid": "6c3f1ffd-98e3-47d4-b984-95ea8f121f97", "comment": "Malware payload (Mirai)", "value": "a5ad51a86275a669ff8ef197edab9c5481f595f7e71d021a193eb79d3ea3d09a7e8785bcf5b7c246492df590a3f785e0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308617, "uuid": "2e51d66c-fd43-49be-b3f5-4ac64f5348b2", "value": "T10DD2D03130C968F0C3B8AC3A76ADDA45135A17F9F2EE683E9C79425C75D645EEA30306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308617, "uuid": "c2769ae3-cb21-4c3a-abb1-29a71324fdca", "value": "768:bvoZP50BF5FcUajUt+NFpD/4+OztiC3Wys3Uoz1s:LoQBF5Fc1sazz4+Ozti0cz1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651308617, "uuid": "1cb2a29d-bdfa-423f-883e-28fac3585e50", "value": 30004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651308617, "uuid": "5275a862-f81a-45d6-80dc-9a13acc466bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308617, "uuid": "2c9892b3-d7c3-4b32-8333-221bdf8ca8d8", "value": "Tsunami.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99730e3b-c820-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651280288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651280288, "uuid": "9472e057-2a68-449c-958a-862f6a66a1d2", "comment": "Malware payload (Heodo)", "value": "35d7f073d8561ed78972a30988ca3ab8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651280288, "uuid": "38bcac94-703d-4092-a550-88de804175fe", "comment": "Malware payload (Heodo)", "value": "9e74a7641a8ae3a8ca9fd97675d604d1b91bcaa32de882bc9ba0f6658a9b9738", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651280288, "uuid": "24e9d877-f6fe-4a88-bfb8-09fb3846601b", "comment": "Malware payload (Heodo)", "value": "5d99ac6a3412c4ab2cd186c2152850f07f90e9d5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651280288, "uuid": "b594d2b3-7f58-4e1d-9d47-37294d9d9079", "comment": "Malware payload (Heodo)", "value": "b27b49ebe64ab41063011601d532464c169ae08b1c8709daf8d9c27b1e06fcfa683ea566093a31754aae958b97bdb425", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651280288, "uuid": "8b5d6023-3046-4758-8088-f9bf429de512", "value": "T173056B316143827DE95F6636ED22F7F6225FF81147B096E30A442EFC89744EF4636A82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651280288, "uuid": "554f722a-b828-4c88-bac0-f5e303930963", "value": "1e8e7e5b053a6113954e3e4d9100279c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651280288, "uuid": "8b1bc43a-7fb1-4726-9cd4-93036430d531", "value": "12288:Jualogyxm2HRLaJYiNLCRACQ+rGYPw+PYF7o8v+R:1ogys2iYaIGYIY8WR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651280288, "uuid": "449929c7-2ba3-462a-8df9-a00b22a7b592", "value": 864256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651280288, "uuid": "f48caab7-d80d-4cdf-a9f2-3f6ba3fec2bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651280288, "uuid": "30a79d57-cc34-4167-8049-f0f4c7cf325a", "value": "emotet_exe_e4_50320ddaa5cdf45993a8d8d45d3a6965e4e18398118f8ca49e0cb9d51d978411_2022-04-30__005801.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec82662-c843-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1651295436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651295436, "uuid": "1747edae-b9d7-43ab-b457-0969f270f565", "comment": "Malware payload (NetWire)", "value": "4f1ad1323336fdc6e7ced82feb4a899a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651295436, "uuid": "96b2ecc7-550e-4ab0-8ee8-f8d388677229", "comment": "Malware payload (NetWire)", "value": "9ecbca724efff37c8218d41e3263ce8a2c1e34647b216106e48ea3713daeb4ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651295436, "uuid": "f038a560-569b-4842-9c2a-d1e8f83bef4b", "comment": "Malware payload (NetWire)", "value": "c0186f3b3a7eaf08876c578e2dd79b2003a4c003", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651295436, "uuid": "8bac7f07-abd5-47d6-89ba-f23a12663a9f", "comment": "Malware payload (NetWire)", "value": "80f3bdf73b47a29f68ffb954782de416ab8ae292e19694515bdc34ef9cfce7d1bf12cc23c0ce97652c79c07046c30355", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651295436, "uuid": "62e67b58-11c7-445c-81db-76c5e7a1eba6", "value": "T1EE540120A7C0D466D9671E34C135AAF62F23AE1EE452560F1BA07F5B3D32192473EF92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651295436, "uuid": "eaea6dd7-b3cd-414d-8569-96f2ba53ee9e", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651295436, "uuid": "61c0cf3d-7469-472b-b2be-0b363cfc1616", "value": "6144:1NeZsW4yWRl+fU9pumj/+g7Me26gCGL0B8v2qEBtWugTsL:1NiqS8Kmjp7DUluBtWugTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651295436, "uuid": "7cbd7b27-fb50-4f76-9901-47334ba6510d", "value": 285656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651295436, "uuid": "ec018253-5e32-4e76-9694-50d7c3d4932d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651295436, "uuid": "e5d13de6-ec8b-42ce-a94f-d36f28ccd86e", "value": "4f1ad1323336fdc6e7ced82feb4a899a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f7533f-c851-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651301329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301329, "uuid": "9552c78c-bcdb-4554-99f5-8cd57838e82a", "comment": "Malware payload", "value": "8006634c4fc50ef3422906e51b8661ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301329, "uuid": "f7fd52dd-5fa8-4b73-ac40-a7d27789de3c", "comment": "Malware payload", "value": "a49769b8c1d28b5bb5498db87098ee9c67a94d79e10307b67fe6a870c228d402", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301329, "uuid": "56d9573a-f864-476a-bbb4-303342bb5b65", "comment": "Malware payload", "value": "ddbc4701a6e3c6c5534a2e140dd42d01fbc166e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301329, "uuid": "2e8df825-4302-40c7-ac6e-54961736f46c", "comment": "Malware payload", "value": "81b12d0f8b6a88e373a9b00ab93ee2a883c9307c4ef3ff2b96054cb36e758154325916d400a3fccf922c9f76559c46e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301329, "uuid": "fbf3889b-3289-4db6-a714-35a1e23fb20e", "value": "T186732AA5A2616FBBED172EFD508F44DF1BAFCFA312C201223BF555D2CA00198541AD6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301329, "uuid": "cf87a679-3591-4e7f-84db-63539b0d666b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301329, "uuid": "bd384814-ad17-4886-842e-8bd8d740c08d", "value": "768:XUcmuqnbJfXFHGfLfeJh2LlkrTX7xmeN7pgrgcGeaROke9nnaTZJqqtTihkSb6:BmbL+fYIlkrTLxzNagcG9eVMJh+z6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651301329, "uuid": "5f843cf7-1230-4a91-8248-51462170ebc4", "value": 73739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651301329, "uuid": "ee1735e4-df67-4c3f-928a-233102548e2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301329, "uuid": "1a512fc8-7658-473a-a065-0cd8ecb11ad2", "value": "8006634c4fc50ef3422906e51b8661ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b84c5d1-c881-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651321899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651321899, "uuid": "db513bf2-2c64-4871-a665-853a26570f5e", "comment": "Malware payload (AgentTesla)", "value": "9b0d8b58eabb6520f298d51dc795b935", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651321899, "uuid": "b30f6d67-36bf-4e01-a002-94c6250a30d3", "comment": "Malware payload (AgentTesla)", "value": "a4b16bb40b9761392f30ab79b21fd51d78c5bc47b43d168859d0459f18b209b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651321899, "uuid": "eda1089e-585d-447a-9124-bb46543b70f6", "comment": "Malware payload (AgentTesla)", "value": "4cd3d0408fd6ab069e087c42a9cd3b3fe0faa59b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651321899, "uuid": "5e66b4ea-6772-417b-8bdb-8edc2954ea33", "comment": "Malware payload (AgentTesla)", "value": "a02328ee8b37fb1e7b664e8cc3fe1de2818a477770fdde26c6ca6a12a9f0ed0bccc1f26383aff6f18969ae978cbb1d55", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651321899, "uuid": "11a05066-ac6b-459b-a44a-6d25a0fed1ac", "value": "T138A423DA5825496D6D0C80F916FA5BC86DEF8F3D96027BE063B035C0E477A41734C9AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651321899, "uuid": "b1299558-e9fb-4430-ab68-d4ebad30a5a1", "value": "12288:4sb8yc8xjCf+TLqKKDx14yedrXfpuT3JXzCcO4Me18:4KgcBTLsDxaLpuTZXzCaMu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651321899, "uuid": "cc38beb5-f00e-41ad-a5d3-9e96c7129259", "value": 483387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651321899, "uuid": "5209f885-501b-4875-8728-b9cad1b579af", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651321899, "uuid": "acc2e1df-501f-4a1b-9358-0c546978f714", "value": "ORDER SPECIFICATIONS OUR DETAILS # 76645524332MCD 2677863.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d20f6aa-c853-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651302171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302171, "uuid": "cb29813e-647d-48a9-b303-056c6adfaad8", "comment": "Malware payload (AgentTesla)", "value": "a5c0f96b99b15ae29abb5c639d17e144", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302171, "uuid": "1deb81a9-197e-40d1-9856-0b625e6e8787", "comment": "Malware payload (AgentTesla)", "value": "a568fba925100a04e85d652d5612d3d6e9cdb60d4c2d9abe7927b543967b8bc9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302171, "uuid": "011cfc6a-d5a7-44c0-ba18-783827786473", "comment": "Malware payload (AgentTesla)", "value": "86c4e70afbb9fd7d1ebca2f49952c83f18ca6299", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302171, "uuid": "e05915de-0c54-4d8a-940d-d11f683186d4", "comment": "Malware payload (AgentTesla)", "value": "13fe4db41f82b34f1415b552760d2949f9ecc0f89015be4942110d6e2891f3e8772832017be59bfa4a50f9b72841bc7f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651302171, "uuid": "9c80d06b-132c-49e8-88f9-97e1fcd18510", "value": "T1C5D4AD032E9C76CAF96C57B91826E13477A8ED992D20DE1A2AF03EDBF530740D504A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651302171, "uuid": "70db5aec-0392-4f67-814c-cecb88a6f163", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651302171, "uuid": "30e2813f-9a3e-493c-8abb-b6db88b5db3b", "value": "6144:FkEUh83IwP2qw4aVPJ+qcv750vI/7BpadUJ56JoEoQzOadywdrV6UWqkKEcLR5la:Fd0qw4+kqw50QVHr6elDq8UWXKEcxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651302171, "uuid": "71e96c63-b6ef-4dcf-b6ae-dddb95f9ff74", "value": 627200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651302171, "uuid": "1ecb7cd2-8950-43f9-a74a-bf73b0c2cc11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651302171, "uuid": "73f07f71-586d-4b77-a63e-95d41a9a2426", "value": "ORDER SPECIFICATIONS OUR DETAILS # 76645524332MCD 2677863.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2fbd339-c8ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651346500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651346500, "uuid": "40ab6ecf-81af-4bef-ba30-5cf3ea960d52", "comment": "Malware payload (Mirai)", "value": "302156895e1dad3a9571305d873bf8b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651346500, "uuid": "3f043b01-6e38-44e1-b47e-d2ec9ddda8a8", "comment": "Malware payload (Mirai)", "value": "a68fb4b399d85528256364ea2cd61aae85cc5e1210a0a4438b709a87eb9aaa89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651346500, "uuid": "a9648e3c-b267-46f7-847c-c1cdbfa71dad", "comment": "Malware payload (Mirai)", "value": "c906fc3d80edb795baee5da4c7139afe73a7dc51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651346500, "uuid": "0c1d6765-7545-415e-99e3-532c7d9c0775", "comment": "Malware payload (Mirai)", "value": "dd948fe62cadbf9a3a8b27fa1b9d3a96b3bc97d801249f02b63d2f565544800a33366c85c08e2c2fa73bf2da04c7fecb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651346500, "uuid": "98b660e8-9223-4c8c-818c-2a3c311f910f", "value": "T16853BE32D41CAD90D1694138BD248E785763F50965A72EF64F968BA68007EFCF62C3F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651346500, "uuid": "a26e2999-7072-4f8b-9b3e-2a1e61a10c84", "value": "1536:M/ov+7AZOuaBwtFie0Q5qP4nwFRaTop1V7CVu:MgvGYJi7eP5qjRaTop1V7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651346500, "uuid": "254092cc-5823-47af-8616-e86ddec593c5", "value": 62500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651346500, "uuid": "ba5ce4d9-7a96-4d0e-a801-ece49ff30cba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651346500, "uuid": "cb3f64f6-9d2f-4d49-a2ba-9162fc5d8cf4", "value": "302156895e1dad3a9571305d873bf8b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758bf4a0-c876-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651317164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317164, "uuid": "1fbfdb90-173e-48be-8787-c27602f33f0b", "comment": "Malware payload (AgentTesla)", "value": "51828e947977e8749cad9e807cf767a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317164, "uuid": "efd8e6ad-3a8c-4415-bacd-f3f7de24f3db", "comment": "Malware payload (AgentTesla)", "value": "a732b6aec0170cafe69d1a6fd1b2e092330f7246a9c4128662ffa69d5f18d5ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317164, "uuid": "27e68e9d-a6b9-4ef7-9e03-6864ebc0f464", "comment": "Malware payload (AgentTesla)", "value": "3ea1d00ab4ddc1568eee7bb7592d5a4960273489", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317164, "uuid": "5c628744-a8ed-4063-a95a-5573d0f6616b", "comment": "Malware payload (AgentTesla)", "value": "3f245401eb9fdba084938a01482c15e47fc3590557720a760b61a7e28089367529425dadece3b6686752daf9e3b7ff97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651317164, "uuid": "2f88fe5a-6fc2-43b2-8df8-ac697db42017", "value": "T1A8C423B460E3E5F985B3ADDA10C6AF9CF388CB4747438069AB7362EE31761994780F15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651317164, "uuid": "ea51cc9c-e7b7-4810-bed9-90467e2700db", "value": "12288:W9UhKAUZPd6xUro3NEov8Fjh8BG9Gx1mvdtx2uRO/2xha:W2HUv6xh18Fi/+dtxb62i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651317164, "uuid": "91fa13e9-33c5-4706-8d84-3360af5e259d", "value": 586922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651317164, "uuid": "734e5306-f6d2-409b-9bf1-a8ed89752f64", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651317164, "uuid": "e15768a2-fed2-4d8a-a5b5-b1f4eb55fe54", "value": "typical COA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "605c002b-c851-11ec-8e58-42010a9c0032", "comment": "Malware payload (N-W0rm)", "timestamp": 1651301237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301237, "uuid": "be339f0a-0589-48da-886f-ffa7a79cf6a6", "comment": "Malware payload (N-W0rm)", "value": "ab4d3b85c179fb6a9262ad21e4837f47", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301237, "uuid": "52b0ae6d-bcd7-4e8d-a0c8-a02ead886518", "comment": "Malware payload (N-W0rm)", "value": "a90ac3ddaf7df9aa376a9453013cdf3c5ce8951657964f0c509b6de756f18870", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301237, "uuid": "5f046b87-b244-43ec-abb6-f8c11a3c69ef", "comment": "Malware payload (N-W0rm)", "value": "04fd833d18c5a3000caa0a1a48329757e51e73d9", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301237, "uuid": "3ef8501c-ab21-43cc-b13f-1dd7d4738d6c", "comment": "Malware payload (N-W0rm)", "value": "a12358e5470464614f508f80a8666cf4400fc207c195c24dd3c4afdb2ece0216ce41c5e49bd11ae43b4d67e395fbf154", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301237, "uuid": "f6d749af-c665-483e-9ba0-89588c847ff5", "value": "T139D484922764E54DCA238D7705D8CF440388C299DA7D579B30AAE8E4AFC3AE50B4B1D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301237, "uuid": "842678cd-65e6-404e-86d9-20c7216473d2", "value": "48:5AMrDemmiIBCD6U7BeTPWwY5oQyJ+sW1WxMymEQUe:5femmiP6U4POaJ+V6bmEQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651301237, "uuid": "72e69ef7-9641-4d65-9b5e-12b34a52561e", "value": 608256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651301237, "uuid": "a866cec9-a0ab-4de8-93e7-c93d1843dd39", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301237, "uuid": "182b22b8-268f-471f-80cc-18fc8dcd672d", "value": "ASNQSKJPXJLKFXSIEUQYZ.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab121b2-c8cb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1651353734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651353734, "uuid": "71e14c17-9e80-47f6-9634-57a34ffced6f", "comment": "Malware payload (Smoke Loader)", "value": "8f70a0f45532261cb4df2800b141551d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651353734, "uuid": "96ac0c74-7255-4bcd-aea5-3c3b2c7bcec2", "comment": "Malware payload (Smoke Loader)", "value": "aa2c0a9e34f9fa4cbf1780d757cc84f32a8bd005142012e91a6888167f80f4d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651353734, "uuid": "7cb4b8f6-ae83-4013-86b4-831f518c5f9b", "comment": "Malware payload (Smoke Loader)", "value": "521bbc045dfb7bf9fca55058ed2fc03d86cf8d00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651353734, "uuid": "82667687-4219-49f5-ad62-1d588ce107c5", "comment": "Malware payload (Smoke Loader)", "value": "96ac9376290ae7a3d111db798f488e6e84f1113a5b49afc517f392dda0fb69af41bc2d27ba2fb0a85aaa65fb073806a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651353734, "uuid": "1394ce71-0d00-4998-b8f6-21b23214cc81", "value": "T143F36C297AD1D0F2D972053638E4DBB0C92DBD301B60599B77852B3E6F302D25E61B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651353734, "uuid": "71c3b40c-3d5e-48b7-be38-30d67b397479", "value": "5f7ff46e2455151e54d09d2ee5a3df5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651353734, "uuid": "a41586d3-1aa3-4803-b07b-b23fc346f056", "value": "3072:ApO0Xavhlw60rsxWJ8D3yfiqIATrEFvEERHX6hS/6ZuPQXSon+k79eX4Yo:0/o8rsxWawiqDAxHX2SyZuPQXzqIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651353734, "uuid": "305c2cdd-669f-4012-af23-5b38c1f50dd8", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651353734, "uuid": "9dfe86d2-d5cb-497b-a48e-73e080c4786d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651353734, "uuid": "fa644e9b-3470-4aea-95b2-775879bd1a81", "value": "aa2c0a9e34f9fa4cbf1780d757cc84f32a8bd005142012e91a6888167f80f4d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed17de44-c873-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651316076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651316076, "uuid": "74ccbe17-1b03-4738-944e-07bdef1a4422", "comment": "Malware payload (Heodo)", "value": "f42bb2de4a9dc69939275cddfe8df3cb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651316076, "uuid": "a7ad84e1-1806-4091-a28b-05b228fd067e", "comment": "Malware payload (Heodo)", "value": "ab702dcae21bd2134442cb0653baa035e3c134dac3f13b8549bafb8e81950d45", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651316076, "uuid": "c4715e0f-6d2c-461b-ae79-ad9b982edea2", "comment": "Malware payload (Heodo)", "value": "695aaa5e258c7b7703c52d7ddfc4523b1c0877f1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651316076, "uuid": "d9c42875-4003-4596-98bf-11d0a81d4dc8", "comment": "Malware payload (Heodo)", "value": "47b6e4fc49158ef406b56628128b6c206a31427606705a5d41501cae7664a69563834beda864598af4e383b1945c4067", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651316076, "uuid": "2212c5a8-79dd-453d-8354-c91e92cd4efa", "value": "T1E0C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651316076, "uuid": "9cb38412-1002-4ebf-8211-c1c0c8211118", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651316076, "uuid": "7ce2ac14-b2b2-4165-b89c-e5adae8b5936", "value": "6144:JhZ02GdOOgPYLKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfIKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651316076, "uuid": "dbba041a-70c1-43bb-93f1-dbf2f3b4adf4", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651316076, "uuid": "e8489b56-74e1-435a-9670-b5916934d7e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651316076, "uuid": "fb1fa03a-2ef6-4248-a85c-b46950e24391", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a10bd847-c81d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651279012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651279012, "uuid": "efa5bc5e-32b2-4da2-8d4f-055e997cfd92", "comment": "Malware payload (Heodo)", "value": "a24bf496a031939dc7fb3a98a67e1155", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651279012, "uuid": "40b8a497-dc28-47c6-a367-d419c306d6be", "comment": "Malware payload (Heodo)", "value": "ab9eaf7e6dfd26cc355d0ff941cd884029fca01e3080b012da6784eeb2c22221", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651279012, "uuid": "1d526145-9ed9-47ca-afe2-2f9020ced514", "comment": "Malware payload (Heodo)", "value": "93c45874ff44be044330b3697e58430ec052e2a2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651279012, "uuid": "66cec2bc-1ad1-4157-81a8-1786c9a4f06f", "comment": "Malware payload (Heodo)", "value": "641243a9a0640d43b7bd9cbebd272d1c104f96e2a47325bd894f6e4aa210f082eb542b7aa191ff7f803a99d64af62a19", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651279012, "uuid": "82ed7c18-8131-4a15-bccd-bf0514d49321", "value": "T1B3C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651279012, "uuid": "2faa951a-ea9d-450e-953a-9882ddb3e17e", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651279012, "uuid": "4076569b-1f9e-4750-8749-627741403be0", "value": "6144:JhZ02GdOOgPYZKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfCKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651279012, "uuid": "b834ad5c-be08-471a-a50a-9a5cf89b44b5", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651279012, "uuid": "d9cf184a-9773-41d0-8278-5609c9e74715", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651279012, "uuid": "2d7db99d-ead4-4d96-855e-39213048bc7b", "value": "a24bf496a031939dc7fb3a98a67e1155", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f358c76-c862-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651308617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308617, "uuid": "0ef508d4-ec67-4f2d-a0bc-ed1b9615ee0f", "comment": "Malware payload (Mirai)", "value": "9abd4ca007d69df7182cff6314cb1602", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308617, "uuid": "91b9508d-a769-40e7-a343-2e428007052c", "comment": "Malware payload (Mirai)", "value": "ad16090ebcef445b6376447b47f11f77dde1b7fb19787c3e51c7ee48b44c83c8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308617, "uuid": "5d0562d2-bd38-4abc-b7bb-96ada02d0828", "comment": "Malware payload (Mirai)", "value": "c1e86c097dad838519d6b61995068bfadeed20b2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308617, "uuid": "b586e03f-726b-44bf-8c92-d1f65169a165", "comment": "Malware payload (Mirai)", "value": "aa39939a555eb9a64fcad2aca61842f3cd39d6fcad93c1bb6baf715217aa2d7f17519a4ea1486067f44cf83dff61a1e9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308617, "uuid": "2a606850-0824-44f6-9a7c-1e6c1aaff5f8", "value": "T1AD832A857840A626C6C952BBFB1F028D331623D8D2EA3307DD255F70778B92B0DA7756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308617, "uuid": "02d9030d-bb44-4467-9318-e7afc7468766", "value": "1536:1MehJd15Jc27J3yObe8jKSTK4wnPg+7rI11DpivPe9sNvYA5lB:1MehJd1tJHbugw4+7rI1q3dLbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651308617, "uuid": "5b0d9ae2-a5f4-4228-bbc3-5ef7cdc7d560", "value": 87688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651308617, "uuid": "0fc8619a-d7e3-4aac-bed1-49e100968d67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308617, "uuid": "36f90a85-50b1-46b9-b5cd-d9ce08ae81d0", "value": "garm-20220430-0850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fbc52aa-c853-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1651302122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302122, "uuid": "1e1c2978-47d0-4cf5-a16c-c63d8e38a853", "comment": "Malware payload (NanoCore)", "value": "1645892695178fcc1bc7ed56b21da482", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302122, "uuid": "105ff33f-cb43-4dbf-af17-f72931369724", "comment": "Malware payload (NanoCore)", "value": "ad727ff3937bd2292c7561969868e971be6ff623bef51b5dbb38207593114d76", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302122, "uuid": "ff1c9dbe-3b08-4b3e-87b4-97e37aa52428", "comment": "Malware payload (NanoCore)", "value": "ec26894e1f2f70a6ba2037b62fbe1caae2d78ab8", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302122, "uuid": "d916cf71-543c-4730-a9ba-b01c8a242c64", "comment": "Malware payload (NanoCore)", "value": "798ea0349bfaccc7f246cf0208c7ae52041d2737975e794e7ea0c5c1ddd1d663223f105070f1da6e99742c0c67253f43", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651302122, "uuid": "3279a358-3844-467c-9bbc-ec63b52ec797", "value": "T17261852D406DF1CD67484616AE8DD928AE9C03FFE7B4547A3C30956182087D5B03AEE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651302122, "uuid": "3eec9cb0-a4e8-4639-8e1f-61a6b580acc4", "value": "96:VVpvXs6TtCnvLv+q3JV1mhCrzR3EBbrCY:lXzTtmV3J5F0Brt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651302122, "uuid": "3a4e9f71-76c3-4df5-91fb-2aa12b4e0abc", "value": 3252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651302122, "uuid": "64074a0d-2fa8-4a39-b354-4beae3d5bb9c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651302122, "uuid": "7e302472-6e97-4b3f-8848-a84ea49e0c9e", "value": "CHECK#718263.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d733e5b-c8b0-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1651341954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651341954, "uuid": "ded0e55e-cf0a-4afd-b8d9-820b9a77652b", "comment": "Malware payload (DCRat)", "value": "06d593dc8b68cb39be80310856a28b9b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651341954, "uuid": "279c6c2d-7e80-4b63-99a5-3ef849e1206b", "comment": "Malware payload (DCRat)", "value": "aec47e1bade2098d68dbfae1db4c37514906d510f6fd131bcd4986f15003edbd", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651341954, "uuid": "e16737f5-56ce-4139-868b-4a5852283c77", "comment": "Malware payload (DCRat)", "value": "bc99e24b26a147d957d206146613e7ca3ec89f74", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651341954, "uuid": "0c78e0db-23e5-46a6-9200-e48071030f7b", "comment": "Malware payload (DCRat)", "value": "62d61ada1cd0269e7ba93e4f0da69121f7cd4146a4ac0939c633017ba8394977973606f63b091ea6f2428d847788bfa3", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651341954, "uuid": "ff610f14-1c8d-4dee-a94c-a32e49cc36bb", "value": "T1E095AE427A54C953C1252B37C8EFE52887B8BE627A16CB4F7E9E335C19113F66C091CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651341954, "uuid": "78cd0db5-52f3-43f0-9e4b-70faff1bb473", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651341954, "uuid": "8c2393d5-db6f-45bc-8060-a7c54c7addee", "value": "24576:I2G/nvxW3WKErzwQDl2EECtMntEs9ZLg88Bx2WiVL6gWYHauhTYo/9GnB2TS1vQ4:IbA3bgzFYECVvg8Ox2mn4ivQ9H5xW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651341954, "uuid": "e7dfe551-b2e5-4bd8-b689-23cd3c0f20c4", "value": 2014941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651341954, "uuid": "48d5e45d-3ce9-4629-9a7b-7adc38ffdaa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651341954, "uuid": "01d69d34-38d3-435b-a02e-25f969a1ac75", "value": "AEC47E1BADE2098D68DBFAE1DB4C37514906D510F6FD1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700aa7a3-c88c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651326604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651326604, "uuid": "432a7f87-ff27-4ace-bb1a-2ea16d83a4bd", "comment": "Malware payload (Mirai)", "value": "3884b632362040fe749169764fb00d0b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651326604, "uuid": "a98f8244-6a9a-4600-b59d-321639c130c3", "comment": "Malware payload (Mirai)", "value": "aeea430e9b9888e5e721164f8cd498420c334bc705a09c061333a9948cce16c9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651326604, "uuid": "d8151d2d-7767-4392-a5b2-b004e5558d02", "comment": "Malware payload (Mirai)", "value": "1f3cb7e925e56effd94316ed6bbe7717e8e232d8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651326604, "uuid": "71706f27-fb3e-40e3-ab65-b2cdfa23639c", "comment": "Malware payload (Mirai)", "value": "0bea88ee97bde3dbc701d01133d89e03477a0a00b3e1d7c5a090f9b13027620e63eec2e11f9927d84719af7542d34b65", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651326604, "uuid": "d8c9005f-051e-4032-ae40-dc2687de9dcc", "value": "T13533C7566E214FEDF66D82354BB30A21A7AC23D623E1D785E29CC5041F7034E546FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651326604, "uuid": "1321132b-946d-4c0a-aac0-e21d76018184", "value": "768:KVLQSo9tSWbtc/mWRrh3KCxyhzf1epap1yXQIT:6l+jcdZkCI1ewp14QM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651326604, "uuid": "4ab52b4d-8a15-428f-897d-fa88cca266e5", "value": 51760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651326604, "uuid": "77fb6e0c-3c40-43c2-a6ba-b05d581d71af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651326604, "uuid": "2d9b2bdc-d084-40ca-a283-722a3eef07b3", "value": "beamer.mips-20220430-1350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4686b5d3-c827-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651283155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651283155, "uuid": "37aa8a5a-ca68-454a-8e8f-b16a5d1c6ca9", "comment": "Malware payload (AgentTesla)", "value": "a8cfcfde5eadea73b9139fc1e697ed82", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651283155, "uuid": "618354de-29ce-4e6a-9e34-8f0b630021b7", "comment": "Malware payload (AgentTesla)", "value": "af291d2fa025a2a74059b4e33a5d2614401851c5e23ae419f42419982f7e0862", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651283155, "uuid": "6584d604-b626-4617-bf6c-02a2084ce938", "comment": "Malware payload (AgentTesla)", "value": "33182555764ceced9d41414aef9b9692d54b3e3c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651283155, "uuid": "cfb01868-aad9-4c4d-8cda-1f26d00317e4", "comment": "Malware payload (AgentTesla)", "value": "b33e9cc23e797e23a3346546a1d39826021fed861a16c0e710f75873f0ba1ef75ff54f9db745ba691dfcdf1335163f08", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651283155, "uuid": "a5a14269-aae4-4722-bdda-cc4d867751d1", "value": "T159D32BC2A744DE9BE56D4D70C5A6A49D3719AE6A84C08F8EF8C035DE0E77258312FC4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651283155, "uuid": "6037c3fe-5706-4249-add9-604c685693fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651283155, "uuid": "eedd4725-471b-4670-afc4-ba94756686d2", "value": "3072:ykONvX5n4AdI7IcIclIyfT5ztihCDo08y:yvNvX5n4eI7IcIclIyfT5ohCDo08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651283155, "uuid": "62855e6c-44bf-4148-acb1-afffcff77168", "value": 130048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651283155, "uuid": "ca5db24f-8cf6-4973-bdc5-ebed2c5d6e76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651283155, "uuid": "71774def-1f21-4270-ba63-ab48a947545f", "value": "Aviso de Pago 29 Abril 2022.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20577c0b-c826-11ec-8e58-42010a9c0032", "comment": "Malware payload (ZeuS)", "timestamp": 1651282661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651282661, "uuid": "2075ab96-bfaa-4ffd-a0fb-8d83c72b0b40", "comment": "Malware payload (ZeuS)", "value": "1623c04f565f4094cf7e9553cd0b7cb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651282661, "uuid": "135bc782-6b3c-4a4b-b5a8-fcf1375c45e5", "comment": "Malware payload (ZeuS)", "value": "b284b6cc53f3fd14bbe580e7f2313d2647c53158069c7249e86edb4da749e408", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651282661, "uuid": "1996f9d5-cf2b-4b8a-86ff-6aa8a707c190", "comment": "Malware payload (ZeuS)", "value": "68005bca91fc77644f64fede44790274ddd9754f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651282661, "uuid": "5f0e59a8-ad6d-4344-936b-bbc76a6992db", "comment": "Malware payload (ZeuS)", "value": "7eb814160d0358cc9781eb2cdd55e5c8cc8bd91bfe51ee08050320a8c73e34df33067e91e4137c8f31237844d4d16c67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651282661, "uuid": "ba07afc9-7ad0-498c-a915-fb34823ef9bd", "value": "T14F936C91E7E3403DF8FB563106720673CEBABD20AA75C11E96D14B5A4F31BA0E426393", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651282661, "uuid": "81904253-1444-4a3e-9616-7eb3f3fb2014", "value": "1536:TB25NOwD2OmVPt10RqIrwvMmJYumiEq49YAfBWYydhK:TBIOwD2TP6bMVYumiE9YA8JK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651282661, "uuid": "e28e355a-9a8a-49cd-af24-00ca4cd899e9", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651282661, "uuid": "c331b385-2933-454f-856e-4544295119a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651282661, "uuid": "904b664a-a881-46cb-a203-f8e94b3d30ac", "value": "b284b6cc53f3fd14bbe580e7f2313d2647c53158069c7249e86edb4da749e408.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e88d5dbd-c86a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651312203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651312203, "uuid": "dcc60ca2-ae46-41c7-87b8-2d524ab04918", "comment": "Malware payload (Mirai)", "value": "fa78bbb30659a4564c51364d0b1b36dd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651312203, "uuid": "8f37b5d1-000a-401b-a213-679d9608fb51", "comment": "Malware payload (Mirai)", "value": "b2da6b905d76617226d3010ecf841737f06296ee3b7ea4042b2aa8f2d7516776", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651312203, "uuid": "846edc9d-8ac4-407a-a2d7-bf13d24d529d", "comment": "Malware payload (Mirai)", "value": "e68327ee34e530b4c5c32093eba44a041a3fab3b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651312203, "uuid": "7e7e1437-7ff2-4ceb-96b9-d256dd3e1187", "comment": "Malware payload (Mirai)", "value": "543596a2c09acfc5e7bc683713d167626ce6b122b88394e0fbc75a207ab888f7b4c8e3774c665a2a18183c74bddaea94", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651312203, "uuid": "e4686589-c3c0-4073-80e9-9a5ce71c32bf", "value": "T1EB530238F9CF42F086C558B6ADF59B1AE0CA5F30B89D50119E506AF84CF58C66E7B2C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651312203, "uuid": "54c6a4c5-d0cc-4b1d-bac3-3bed6d7c63d4", "value": "1536:2uv3Lry+qOi0sD7RbONMJQEDpUS+yMpwOVhSLkSb4UfMjr5C:23jeo7pU9fwcILzb4P4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651312203, "uuid": "ae9b0c1b-ac08-4b4b-b900-5770c5fd0810", "value": 63620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651312203, "uuid": "5e6dec5c-192d-4bf0-9cdd-6bc594074b9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651312203, "uuid": "1b0d2641-5477-449b-adba-6a8e94031799", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7c9b0f7-c82f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651286888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286888, "uuid": "32a2e7a7-8316-44fa-814d-0f27264b3652", "comment": "Malware payload (Mirai)", "value": "466e74ab7f28c3682557d6f0f214b865", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286888, "uuid": "6ed057a2-f16b-47bb-8553-674a6c9d2507", "comment": "Malware payload (Mirai)", "value": "b3567269c2038984a86a14cc80917c82e35fc41397ef4dd78e8d9d6a8147fe1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286888, "uuid": "b95a7093-d0d1-4136-8f01-d67b2a8cb33f", "comment": "Malware payload (Mirai)", "value": "484cc1b4840f9e03499ba448522e533dbbe72349", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286888, "uuid": "3790f358-c901-4f17-8c70-0a3b11f8abf2", "comment": "Malware payload (Mirai)", "value": "ba26ae72ad8314bba343e4147356c80d9c6868d5ca701ca07cacaaec82bbd5fd68a282365ee58882c7ecdc41f46917b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651286888, "uuid": "84a9dc50-68a9-4d61-a0e6-c155d002914e", "value": "T10843E6C2BC82A629C7C01B77EE5F555E3304A7CDD1DA37129C280B647A8E98F0D6774A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651286888, "uuid": "9c8e9730-998f-4ac5-82da-23bb5b498c54", "value": "1536:jZRixo8vz5BCu+L2axsfeZtQktkWgfLP:jZcxwb2aSfwLgjP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651286888, "uuid": "384aa922-2956-4645-ac19-dcc2c641633d", "value": 56460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651286888, "uuid": "9c9a6b8f-3792-4df1-9111-915ffac03b0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651286888, "uuid": "2a4715cc-ae80-4519-9907-9bb03a5b6a57", "value": "466e74ab7f28c3682557d6f0f214b865", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e36c9a-c836-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651289866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289866, "uuid": "7ad1c4bd-482a-47d7-8c0d-f2577fa25d90", "comment": "Malware payload (Mirai)", "value": "ec8b0b219ca615c5b4f1673d35cd443c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289866, "uuid": "fd44c84e-fcbf-47d0-a842-f01288f53e9d", "comment": "Malware payload (Mirai)", "value": "b3570ab69c778e5042c8b1b7f7ee0181ecb965128412c17ca6dbc29db839dfc4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289866, "uuid": "50e7ce2a-d575-4ae9-a734-f3cb70e18888", "comment": "Malware payload (Mirai)", "value": "9b148733acf2594b8d18e07fa28306ce852177f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289866, "uuid": "759950c2-6759-43e2-b361-0ff67c2a9ea8", "comment": "Malware payload (Mirai)", "value": "dfc23abafc11a441ded9dfe551f9a34b371bc7fbf693b8ad7ba1e61c161804d754e211e6084a797a4539e52bd1627384", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289866, "uuid": "db1a219c-ce8b-4784-aaaa-0980a8a2d8eb", "value": "T15FF2E1715627C612DF39D9B2E6618182654B43B4F0FA342817BCC2E5948EE13D2FA88F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289866, "uuid": "82844ee7-3bdc-4fd7-a411-c9e9a476db53", "value": "768:3YVgAxkU1RHz5pq/0n599HbCg6vrojq9q3UELCT:3YyAxdRH9gMjRClvcjfLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651289866, "uuid": "145d2a09-bb56-4590-aa69-96d69d501e53", "value": 34484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651289866, "uuid": "ffecaf2b-a1c1-414c-9302-f0ae0aa081f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289866, "uuid": "35001ca3-9be9-48ff-ae73-647de9bcbc4a", "value": "ec8b0b219ca615c5b4f1673d35cd443c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcacbf5c-c843-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1651295433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651295433, "uuid": "f454bcad-3d23-4dee-9b3b-40ed9b290049", "comment": "Malware payload (RemcosRAT)", "value": "4bb76a097eed7a4118f2bc3d667044eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651295433, "uuid": "3bb4d3bc-97fe-4494-9a4b-fbec7235946b", "comment": "Malware payload (RemcosRAT)", "value": "b3b1ab3c7133e50d5db970b038329ec2f7deb6037f5fd2635c001765cec20931", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651295433, "uuid": "54eb1589-2899-4465-8e4f-ad40e549160b", "comment": "Malware payload (RemcosRAT)", "value": "d2995fea8d5873d02a48d3e65b65d381f9cb9f49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651295433, "uuid": "f9a732fe-2269-470e-a9c0-24b7a2357f73", "comment": "Malware payload (RemcosRAT)", "value": "fd376701a63cc5556fbaaf1d7e257e82b801e99a0c0b485a284be29eb8a546cddfc570764a433798cb5ee6230a21a860", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651295433, "uuid": "7468964d-f76a-44f5-8c44-32a3eb10a3d4", "value": "T139B4DF569684E993C2D10F770F543378D9E2D2F17A0B9B42A9CE0E27444F5D3A029EBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651295433, "uuid": "9881fe98-8d14-4abb-b558-7169aa6f507c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651295433, "uuid": "a0f6462c-b89b-4da4-b1e9-5b17df87a08f", "value": "12288:s42H15+p6KSZIRnOiS5NtmiG3UNFjV1o5U5DWF4h:sDH6kFlgijdVf9WF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651295433, "uuid": "59bab0fb-f319-4e82-ae23-b4834c40b7dc", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651295433, "uuid": "c6bdf95e-d9b6-4ee8-8cd2-db00c04e552c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651295433, "uuid": "b4bf9806-8d3d-48c2-ae9f-02d8be70cc63", "value": "4bb76a097eed7a4118f2bc3d667044eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4da8895-c835-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651289380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289380, "uuid": "234eae21-4074-4f41-9348-3d2caaefdeae", "comment": "Malware payload (Heodo)", "value": "920b3ea2f6bfdc3682cf103e1dabfdc9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289380, "uuid": "997305c4-8751-4c5a-bba6-e883e1db5aa9", "comment": "Malware payload (Heodo)", "value": "b6a5d7591b1e20f1da2b03f955f5c7e8b60288d73df799d2c6d965f829496eaf", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289380, "uuid": "03101c33-26bf-4433-9a6b-fad8a6c1ee0a", "comment": "Malware payload (Heodo)", "value": "dba45b166ee1b7ce48a64e2e559ee29ed163735f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289380, "uuid": "6ca6b788-196f-487e-96d6-c049c00cf5a3", "comment": "Malware payload (Heodo)", "value": "66ae69ebf202e802a6d8866375cbc8a58adb143495753fbc29d18955273ce76b8cf165d6966bfa865a6ab6429143d3d9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289380, "uuid": "e0b18c6b-53a6-48b8-a960-a1ce9207ad50", "value": "T1FBC4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289380, "uuid": "df2bfc62-95bf-45d7-8e53-98eeb089154c", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289380, "uuid": "74366acd-b4c2-45e5-abb4-0fb95c77d9be", "value": "6144:JhZ02GdOOgPY8KUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFffKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651289380, "uuid": "b1a9b0d7-5a18-4dd1-9e1c-b729c2b5d001", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651289380, "uuid": "0a124023-f896-4c86-9132-594381ed6b51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289380, "uuid": "11f15c3e-d7f9-4d93-a5d1-867b93a4a448", "value": "SecuriteInfo.com.Trojan.GenericKDZ.87125.29730.29827", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea48cb3-c877-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651317743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317743, "uuid": "6d0e9c71-4392-44e1-b676-6c9799ab8e14", "comment": "Malware payload (Formbook)", "value": "67fcf048411bb95228d998277b240481", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317743, "uuid": "d1389106-d1b6-4c3a-be17-f19e1f9ea0f3", "comment": "Malware payload (Formbook)", "value": "b74389503568865a8dfaee4698f1d31c98781a1b42c2e7732e1c5153d6730d2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317743, "uuid": "31d2b14f-360f-4708-a8a2-71776de7c4f1", "comment": "Malware payload (Formbook)", "value": "e22980f7875b5ed1425b8dd0be8fe669640f9587", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317743, "uuid": "34aa00e1-2de1-4db1-8ec8-5bbf8edaea80", "comment": "Malware payload (Formbook)", "value": "3bf41f6ce661e3f05c28e2782b704b7727c56fb1d9a9fc5ca9d280b477488655cb9977effb29fa6ee34673b61a4d9c94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651317743, "uuid": "cbbf1070-6458-4c4a-a1ee-0893c6efbcf3", "value": "T199B4E014F2A7CA02C26D0B77C5F345514370E642E293EB4B67D8A7E8192737B4E8279B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651317743, "uuid": "4802b1a9-ca00-45b6-bc69-b2a457a16fce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651317743, "uuid": "1833b537-0a12-4309-9803-facf26f6c9e2", "value": "12288:m2C265S9XGfXnl1/AlyH0T4A4mLwFVUR8E5w:3C2xGfXnPAlf4OLwFOuE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651317743, "uuid": "ffc94ce8-863b-4615-9ce6-5298062238eb", "value": 525312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651317743, "uuid": "0bb31b2a-2a66-41e4-8649-52ebf7902d0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651317743, "uuid": "8d22f340-ad00-44a5-aa41-181f95eac06b", "value": "2022290857-ETA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f65fdf8-c862-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651308617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308617, "uuid": "2997df1f-5859-43e6-9be3-2c01e72f367b", "comment": "Malware payload (Mirai)", "value": "1cedb093af6f4e087ca65bb7b9833657", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308617, "uuid": "7ceac723-ef5a-41ff-b755-3d99bd385030", "comment": "Malware payload (Mirai)", "value": "b791678909832ed727dd9549bfff540560e17052a2c88865cf51b7262c462138", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308617, "uuid": "d27dcd1c-37bb-476f-9c5c-577a86866210", "comment": "Malware payload (Mirai)", "value": "50063d164f3bfbec4380d94a42d41dcd90e6952f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308617, "uuid": "a431707b-5b20-4b4e-9159-f7764a69f2b5", "comment": "Malware payload (Mirai)", "value": "d0f7ce7a2da08db1c2e2210ed4c5d39c166a83ff84195559b61bc8067fac503ce284798ac4141c7a56b9a1ceb3d2fbe9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308617, "uuid": "330b9a84-65fd-4ce6-82d7-e46a7a83bda2", "value": "T19B531889B851DA26CAC052B7FF2F018D371593D9D1EE3303AC182BB0768B95E0E5775A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308617, "uuid": "c9c132f0-cc11-448f-aac4-2ff70ef36d17", "value": "768:fkc4Gf18vcCgwACSAdfTsL45SVq/EoaByFW3Gl3nB2oUlUISI41++ZnxFGq2XKdl:V4Gf1WjZdfTZSE/tWK2wG68B5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651308617, "uuid": "78d40ffc-34f5-4ca2-9e96-8070aef9f8d4", "value": 62460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651308617, "uuid": "a5637cd1-229e-4dfb-a298-853e76d1989e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308617, "uuid": "e7d3c526-025d-4d84-b4bf-1f229b44e490", "value": "arm-20220430-0850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f06f0a50-c836-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651289882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289882, "uuid": "99d78c2e-514b-4a81-9837-494ac4246f5e", "comment": "Malware payload (Mirai)", "value": "03b600a9da8b1e3704039d2893fd147e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289882, "uuid": "fcc03f63-093c-4f38-a383-5f80702cb08c", "comment": "Malware payload (Mirai)", "value": "b876746e401464401162d2fb68d40a2e6bb71b10d4f5e47f46dddf898035911b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289882, "uuid": "59575da3-441a-46e7-a5ab-b8e4d068701c", "comment": "Malware payload (Mirai)", "value": "45370b2abbbba23d695d4a329d3e08137a6bdafb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289882, "uuid": "698a87c3-5ca5-4079-b7da-607b84929a30", "comment": "Malware payload (Mirai)", "value": "e6ba79f667886062e3975671b6a9814cc077f6797fef6f94c8077e2fc84814e881720d25a40b66913e3012e8ef7e7645", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289882, "uuid": "4f0c022b-9730-49bc-b89c-2e63e3809cb5", "value": "T126539FB5C5A8BD99CF698278B61488389723900565E33DFAD741C7A6D00BEECF00D7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289882, "uuid": "b2bdba01-7eff-4bef-b7cb-bb4674cdf639", "value": "1536:B/bivQhunGauwt4Iduhosjf1RYeycfs3QtLok1cY3CJEa:BjiBGFOdOf1Rhf+Kn1cY3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651289882, "uuid": "8566ec4e-4fef-419c-9e4c-a8aeb9e02d0e", "value": 64348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651289882, "uuid": "c0886679-ed28-44a8-966a-29310434a87b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289882, "uuid": "3a491502-85e0-4a02-8ea1-b438fa264ddf", "value": "03b600a9da8b1e3704039d2893fd147e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4ce4c2-c8a7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651338191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651338191, "uuid": "2e2e3275-b3e9-46a2-9e1c-82ffd2a7e464", "comment": "Malware payload (Mirai)", "value": "c5f9a70663ae4810faf45e1f6eb9a367", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651338191, "uuid": "f22399e8-ef7d-4d3a-880f-709bd5524e52", "comment": "Malware payload (Mirai)", "value": "b96a4efdf269dd32be2885fa7973dcc5f484cbd34f505f6c6e50c1942dbe6dc4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651338191, "uuid": "8e8a2260-face-4ab9-bce0-3aa4d8381ddb", "comment": "Malware payload (Mirai)", "value": "07fdb1395d8f1828180c1a53a75fb13864fca838", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651338191, "uuid": "cf066677-a256-4ff1-b673-960750b8f638", "comment": "Malware payload (Mirai)", "value": "a8935c9742ab9ff12c8c625fd270689bff7031ae9d3cb1bb8c7e102dcda131a68c7503440b837603108cd1eedf879785", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651338191, "uuid": "f7bed71e-4c3d-4ec6-9d2d-dc604195b766", "value": "T130D32B4755D5AFB6C183A97A696A25200705EC175B3F1A8B34387BB443BF4CDB00FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651338191, "uuid": "e6dd0a35-e170-4259-9452-cc38cd13e4f2", "value": "3072:rJAlJ0Sz41ByM97xA7XHnHx7Nn8amYstuUgwGTkNg:rJA7z6Bz99EHHn8amYstuUgwGTkNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651338191, "uuid": "2f69e812-5f94-43cf-a6d4-14d6d0f7c464", "value": 137759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651338191, "uuid": "204356bb-2ccc-42a7-aaa0-8c46a1c72d09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651338191, "uuid": "87044f99-d892-4bc8-a2d0-a9cb90c230a8", "value": "c5f9a70663ae4810faf45e1f6eb9a367", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "635c8279-c89a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651332595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651332595, "uuid": "42f35676-14d7-4e36-bf1d-784ae077686b", "comment": "Malware payload (Mirai)", "value": "7cd167116e7779be572df52e8a1c72de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651332595, "uuid": "28369251-f318-4152-a964-c5b2e6d0051a", "comment": "Malware payload (Mirai)", "value": "bb35402207f51b9673230c1c1336f5dc08b51abe46fa3a2f35ed2337ce67cd0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651332595, "uuid": "d2a21c7f-00dc-4720-a69c-ad996e5e4783", "comment": "Malware payload (Mirai)", "value": "a296adeb65d74c56d65d7b620f21703d82443ef9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651332595, "uuid": "3e0cc687-a79b-440e-99e0-3e52fe38447a", "comment": "Malware payload (Mirai)", "value": "0079f6f4f5c9e632794be11054de64f93f66cd284553e8490f0b2cbab40f3f4a2537fb9b9909fdb8823c58d874da5282", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651332595, "uuid": "caff60bc-ceb4-4ec6-a49a-d0cc25e4dfbf", "value": "T121C2E08DEAEC788BCE6D5C76819E5648C98AE08075C717BE2FA54CCDE339127360D06C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651332595, "uuid": "a435b3eb-adfc-452a-829b-bebbcf65d145", "value": "384:nW+ETVLoV9mcN+pCgDjNl06viaEG2yd89s0rZkE3pylsHpW4son7Et/LSiyKRWGe:nmJLomcAGaEX/9sIp4dVonUvWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651332595, "uuid": "6787fcb9-4db4-450a-a264-9c3776066a85", "value": 27172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651332595, "uuid": "c14f3872-b9cc-4afd-b6ba-a0706896a4ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651332595, "uuid": "c9bf5a62-c354-4eaa-8f12-b1acf0e59701", "value": "7cd167116e7779be572df52e8a1c72de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea524b3c-c87e-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1651320796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651320796, "uuid": "21a07f96-7c3c-4346-ba22-7b7203e7020b", "comment": "Malware payload (NetWire)", "value": "9285c51ad56dbb6b9b1e969c4e898528", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651320796, "uuid": "fc1af1e9-697c-4177-b4fc-b0ad33e7d943", "comment": "Malware payload (NetWire)", "value": "bbdeb7f491fc2c180c764e92e2f9cd6e64e760f05787c311e01fbb1f1383e448", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651320796, "uuid": "65344fff-6ca7-445a-b4a8-41f93ceb52dd", "comment": "Malware payload (NetWire)", "value": "ef4f39abdfcfaa10298ca908729ddda581dccb0a", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651320796, "uuid": "7d8ca7b9-4f8f-477a-bdd2-f4e0d9f10cec", "comment": "Malware payload (NetWire)", "value": "a80a8025017ccb7cb7154791dafd3b268cb993903e3d2c7548a6ea5a127768b0453d3600ca278fa31e6b1158e9b46c55", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651320796, "uuid": "bfc59c60-42f1-4985-b93a-be144a546bea", "value": "T191C423785794945AADAC6BCFF1C191D610F9B2C98BAA1C3CC0866F66CB54F4F7130C2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651320796, "uuid": "ce3d3ee9-ae04-43ab-a110-1b082c38e9c4", "value": "12288:B9NJ1/D8UwXq6F1pIDEOhCP3xuHpb9BXt6gvtRLD1g1s:tJlxl69Y1i3x0ph9t3jLDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651320796, "uuid": "dd101d7e-4111-4b89-b0a4-96c47d634c00", "value": 562882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651320796, "uuid": "3ba62891-ed97-4c09-ac5e-79ec9764386d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651320796, "uuid": "9c810376-8e89-40a8-8769-fba36d6e06d0", "value": "INV9004433.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f342924-c862-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651308617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308617, "uuid": "f447af44-20b7-4904-971c-9d31dea39bb4", "comment": "Malware payload (Mirai)", "value": "51244e444cd359f9010c0b575d63fe41", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308617, "uuid": "aff864a8-c0e4-4e62-a059-3146883091cd", "comment": "Malware payload (Mirai)", "value": "bd3175b26df61ac38d212ef1fd1fe1257996bf7791faa169f9a37c731f7d041e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308617, "uuid": "fe002d1e-a72c-43ab-8107-1c8ecaf6f4e1", "comment": "Malware payload (Mirai)", "value": "ab19dabbcc5d5f03851fd82b635383965da05add", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308617, "uuid": "020111f0-6b76-4938-a170-ef168bbd80f8", "comment": "Malware payload (Mirai)", "value": "06cffba86eebdb5b97a2a7128b2e2891e9ba467509bb5f42763080e3cf61e1bea3b45650daed0180b81eb6cc403464b9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308617, "uuid": "495b34e0-3dfc-488e-8218-4c269801ebf0", "value": "T15963F6C2BC41A625C7C11777FE1F418E3715A3C9E2EA73029C191FA07A8F85B0D6B65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308617, "uuid": "27c6185a-80af-4c64-9c72-ac59030aab3a", "value": "1536:IYOZPTwy8Kx0BUP9NSEYsfeZtYRDqPfb/qkIJL:IYOFwuVZDfwRf2kU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651308617, "uuid": "2a75936c-2a1e-4ee7-8f95-ecf7ae301d35", "value": 67544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651308617, "uuid": "973319c9-c4d8-4c6b-9d6d-89c39b472c84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308617, "uuid": "71198baf-610f-43a6-bb30-7507d10e2015", "value": "arm-20220430-0850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df35fc73-c83c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1651292431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292431, "uuid": "24b87636-c950-4ece-8167-a56a7dcdb8f5", "comment": "Malware payload (Gh0stRAT)", "value": "3ca1496fda24d50ed2520e1666c2fb76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292431, "uuid": "537e02e1-02d0-4cbe-85b2-a2bc3272c82e", "comment": "Malware payload (Gh0stRAT)", "value": "bd49aff189329a78f4a14cc9bd8361d31efbb7f7bc9e41c30fba937d23994711", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292431, "uuid": "fcbea74b-4cf9-44c6-94ee-3633d642e234", "comment": "Malware payload (Gh0stRAT)", "value": "6a525097d1a477b4bd35fe7df64d07acfddb2ed6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292431, "uuid": "4cd001c8-bd2f-4d57-858f-06c17c1b0749", "comment": "Malware payload (Gh0stRAT)", "value": "a8827531c5c8724bed01b3027aa5bbaf6fbd5a42ab25cb71530ae0d0b48d7dfae9f89f4713c8eb72a5423b6ad70d77a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292431, "uuid": "cd4b8e62-80ed-4016-92ed-95d462ea2ccd", "value": "T113C38D40F5C5C0FEEE64243058AA3BB9A63AEE7D16195FE7B714CE29682309077063D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292431, "uuid": "b6aaa967-0e65-4d70-8548-dfb26c1ebcc0", "value": "9b49be519a6947a0598917e777270e85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292431, "uuid": "a593a998-7109-4177-85c2-f7bba7fbbe18", "value": "3072:8se5ksXf4AMrGbB8l7jpCb0BRkyEIwvb2L7eG:7eWS0IK1p8wEI6yL7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651292431, "uuid": "e7bf3d11-eaa3-48a3-a3dc-fd118505c1ed", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651292431, "uuid": "1c12433c-7906-4e73-b904-775f6ec48bcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292431, "uuid": "e9097b23-9ff4-42a7-b3ed-fd38ddf477e5", "value": "BD49AFF189329A78F4A14CC9BD8361D31EFBB7F7BC9E4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd57624d-c836-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651289850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289850, "uuid": "b2772591-2492-4efd-a33e-d92ac6b77416", "comment": "Malware payload (Mirai)", "value": "5cc0f78033ec6f20252d9ff98ffa9a50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289850, "uuid": "a2883e51-18be-43d1-92af-2bf403ea85ac", "comment": "Malware payload (Mirai)", "value": "bdadfc3c3a30e0edfedb7f09e557a37309820edb8a0b0849433165f54767a82f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289850, "uuid": "6e630053-eea0-442a-83c8-d37502f0671a", "comment": "Malware payload (Mirai)", "value": "49fc6af3a385fb121c199ab5ddbd154f5d6267b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289850, "uuid": "09878f00-5ad6-4dcc-8a55-1ff6c26338b7", "comment": "Malware payload (Mirai)", "value": "8ce86f82fe3da03ae82a2aa2dc96ebd6e3ab6e21af49e235aa52f58b3763bb3e76a72c33e42f3885eac2b83eab811fee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289850, "uuid": "f778dd30-d3e3-465d-9f53-7ad9eb8a5e2f", "value": "T142D2F2F0FD78DF49F0EA7B3A8CDA5C1E34ACB867693F8544468207527032C96A1DCA46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289850, "uuid": "083cf2b2-f4dd-4db3-9906-cd7ef22fa9fb", "value": "768:xN8fWlfoQmQAXV/E/QuZaKLNzCTgZmE6NAZscqf:jMNXFl/6XZ3NzYNAZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651289850, "uuid": "caf02698-cc93-4bb1-a7f4-baa6de4b3f04", "value": 29904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651289850, "uuid": "446accd8-10df-492c-8223-65a4baeec13f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289850, "uuid": "57b53a87-66ad-424f-9c2e-13080b35e1e6", "value": "5cc0f78033ec6f20252d9ff98ffa9a50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b8bc05-c8bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651347328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651347328, "uuid": "c199aeb6-7506-4c7a-96df-91c409d2ea19", "comment": "Malware payload (Mirai)", "value": "7fbf0fc29f1487a4a539307f2548ebdc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651347328, "uuid": "c4f6aa3e-16a4-4f52-8038-c8d55783e0cd", "comment": "Malware payload (Mirai)", "value": "be8c413634cabb14cb05ca6e25cb66c8fe0d2e766c641e0d89b918e71efbd8e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651347328, "uuid": "5d5e324d-acf1-429b-a614-fe818031879b", "comment": "Malware payload (Mirai)", "value": "b5feee4f9b8f4ae1aedc73b0f88cb61bad265c3c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651347328, "uuid": "e4b69e98-c5b0-444c-9d6c-f307b08d914a", "comment": "Malware payload (Mirai)", "value": "5bdf3edfccc5691d7ce3262ca7a3e7d1a07f6f5cf011e983a7d425109f71ab1d0a94de3f46a66ce356c1c85ac1423e7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651347328, "uuid": "89d9324d-5540-4f79-b092-d07ddea7f05d", "value": "T1A6635A25F8392E27C0E4A57B21B78764F2F1674E25A4C61E7D720E8EFF1068021677B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651347328, "uuid": "c0bec1da-78c2-4041-b059-d0f590549906", "value": "1536:mAdTC1VSGJta4ZpKRzXERrweBOrQDvEWG5:AUWxn/OrkvE15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651347328, "uuid": "3f044b53-4c26-41d9-9471-dcce5f63a17e", "value": 71820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651347328, "uuid": "a357950f-0699-4bc8-b26b-7a15ffc4d41e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651347328, "uuid": "67ecaa21-afd3-4a3c-be68-ec13122400e8", "value": "7fbf0fc29f1487a4a539307f2548ebdc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd6bf0d-c89a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651332636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651332636, "uuid": "e310b18b-e83a-426d-a871-d8e937a57267", "comment": "Malware payload (Mirai)", "value": "35773e26a2e7a89b97eb2f33bde717c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651332636, "uuid": "7fa585e2-9d82-4b29-a5dc-ef8f18dd7694", "comment": "Malware payload (Mirai)", "value": "c0a55d812243b9eaf292e7eb4d1428b39f3f38cfe928ab3d29cd7a0a5f3893e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651332636, "uuid": "d1541084-1115-4356-a57b-3ba2639ff42e", "comment": "Malware payload (Mirai)", "value": "c8a7cec7cb0e3bd2b2b1f45fb1985bbffc885292", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651332636, "uuid": "509887d4-4d1b-4b7a-a364-cc6ee6c0c6a3", "comment": "Malware payload (Mirai)", "value": "2f95bc4da9d6fbd7fd83aadbb531af09e7381dec6948778a71e885f42cdcf1304ef6ee2195c8df7059ab802b78d83b52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651332636, "uuid": "0a79e735-8abc-4529-9782-3219c63f8806", "value": "T13992D0414395A872E5B004399F69DD02236E47FCB1E6356139240B64FF5692AFEFE0CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651332636, "uuid": "b1bf4faf-21dd-4d76-9076-b1d8987d4525", "value": "384:5QbJx4urkhTMifTUS0UF/H4gxfu/Kb2Os6DfCpMjhymdGUop5hu7/:E4ueIyF/Rb2Os6DIos3UozM7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651332636, "uuid": "cbe60b96-c8b7-4abd-870c-eade1b977719", "value": 21032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651332636, "uuid": "3dcaa490-15b5-40bf-bcd3-0df7bae9338b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651332636, "uuid": "ad7d7d6e-80e5-4e27-94ff-deb81067f2a7", "value": "35773e26a2e7a89b97eb2f33bde717c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ccebe4-c83d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651292579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292579, "uuid": "53e57ecb-6c8b-4d73-9f84-b2f27b7a97ef", "comment": "Malware payload (Mirai)", "value": "95128adce1119e92404e785532064ca0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292579, "uuid": "bbf0be7d-7b5d-4320-b343-05d94370e6dd", "comment": "Malware payload (Mirai)", "value": "c451045a89ed0420ed8047b3325f60a5ea154266c22609ef9164e38900d3c8b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292579, "uuid": "a03283b2-f220-49ab-ae5a-357a8e466c81", "comment": "Malware payload (Mirai)", "value": "e334c5156c93d8c5b782771f0b591029beedf212", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292579, "uuid": "c16b61b2-c46a-46b7-8552-3b68673c7e43", "comment": "Malware payload (Mirai)", "value": "be04cbcebbf4d450822688d03c53ac08cf00a4399c092bf3cd7b3d56c23878bd8483a4effe1f7dff6063461ee04c33b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292579, "uuid": "ed01e95d-655e-46b5-9be9-5f47f79a5b03", "value": "T1BB53E781BC41A669C7D11777FD9F559E3700A3C9E1E932138C240BA07A8F94B0D6BF9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292579, "uuid": "8ebf0624-fe3b-457e-bbc6-89034c4cde3c", "value": "1536:GogI5uRJ7lshCKotdsVKQOdYy33eZtQqQot9:GogI5uRJCQsguy3w39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651292579, "uuid": "40dbca4c-ee6c-4240-8dc6-43cd0afd32e9", "value": 62900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651292579, "uuid": "ce8f4160-77b6-44a2-9e38-fbfc6914747c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292579, "uuid": "29ab290b-1e8b-4201-ab7e-69ba75d7e10e", "value": "95128adce1119e92404e785532064ca0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c389a6-c862-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651308603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308603, "uuid": "61704dd3-2b19-46e9-ae5d-32d5f27282ac", "comment": "Malware payload (Mirai)", "value": "5e9b3285b012846190f7075a37f9d3c2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308603, "uuid": "23e6769e-486d-4a7f-8cf7-08d55e8a4dbc", "comment": "Malware payload (Mirai)", "value": "c55f0d8cc2d12a292aacf57287397d04309976b911268653acf9293c97bd7072", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308603, "uuid": "5cd1829e-e97b-4040-a0ac-e583a55d87c0", "comment": "Malware payload (Mirai)", "value": "dd6f0f6eb761ac95842b0f629f24909f705968eb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308603, "uuid": "e4012e5f-f1d2-49db-a8d2-60c92bd125df", "comment": "Malware payload (Mirai)", "value": "8660c58914fabe95bda34027d0f2d37e13ad69dd8e8a6ec163dc63fdb91697c4d910af1cf3787f48ccc6ccc6b8a86fce", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308603, "uuid": "e9fb61bb-0c1d-4578-97ea-8811c795163a", "value": "T179F34C46A6409A13C0D71776FA9F42493323AB64D3DB73069D286FF43F86B5E0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308603, "uuid": "08a287a2-da4a-4bf9-8ecf-c3d030e7d927", "value": "3072:3r+MgHOqPacajMz2AxOEgHo5oZhPzBx6rSMR5M/9sRYYbmTH92BV:niJZajMz2AxngIshtxgSMHM/9xYbmTHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651308603, "uuid": "d8d9c917-df61-4252-824d-0387d00fb056", "value": 168406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651308603, "uuid": "b6c46c65-c77c-467d-a281-b0d57e2b5242", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308603, "uuid": "51b83bee-f38f-4634-9cac-256fbde58c93", "value": "garm7-20220430-0850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f98c772d-c823-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651281737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651281737, "uuid": "c0c4a93a-5ddb-4d46-b4b0-b28dca69be4d", "comment": "Malware payload (Heodo)", "value": "e84b9503cabb76e2938389fcec3ee422", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651281737, "uuid": "159126ac-1fdd-4756-8e8d-cde9c1a6ba2a", "comment": "Malware payload (Heodo)", "value": "c5fcdef90870a25743ea89c13264564c28b3d234c696f29fc8cabbe64e03fa18", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651281737, "uuid": "7560e50c-af50-4fcb-892d-09823941e052", "comment": "Malware payload (Heodo)", "value": "c76f66a6681db409dc433073507963fd7aa21860", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651281737, "uuid": "f5e11855-cc43-472a-aaac-a326c9abe850", "comment": "Malware payload (Heodo)", "value": "98b33ccd8ce10a1edc916a342ed48f46ba4efe3bb5db08f630d42537c3c7a85312cf9d16ee4ecd4946b12fe4495c0c89", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651281737, "uuid": "4814d7ce-08ca-4d25-ab31-16c3eb5f791c", "value": "T198C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651281737, "uuid": "20f64263-dcd9-43eb-a501-421f774445b0", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651281737, "uuid": "1584d923-ba4c-4736-8765-1e14b6758fc4", "value": "6144:JhZ02GdOOgPYoKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfvKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651281737, "uuid": "a1592a09-a5f7-4aba-8181-8cbbdcc8079b", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651281737, "uuid": "22f9b967-6dec-45f8-a876-247411272adc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651281737, "uuid": "e5de2e91-c6c7-4c72-bba1-4f1ef8404b5a", "value": "e84b9503cabb76e2938389fcec3ee422", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b715c420-c8d2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651356788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651356788, "uuid": "04f766cf-f332-422e-84d6-9714ea39d713", "comment": "Malware payload", "value": "c3b84a9cd4ed7022a36d2fc1a243b2ae", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651356788, "uuid": "8a9d930b-1dbb-4025-9312-9a0db533384f", "comment": "Malware payload", "value": "c6ab69fd16ac66a1085f20eec1a41c33fc1f03eb0253486db15569f32f188702", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651356788, "uuid": "7201a64b-fafd-48d4-9a77-63798da26636", "comment": "Malware payload", "value": "cc0ffadb7f5844ad44230100c0c5b89d795ba1f9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651356788, "uuid": "65185917-7845-4836-9535-7cfec0da7f02", "comment": "Malware payload", "value": "7525b4fefff33f1f3d1ce1b4e8d10216dd40d5fdbdafa30a04cf4204b89252fe202b12bc69a3f33fc651c52ecc3b2580", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651356788, "uuid": "0d0d890e-fcbc-4d23-8aea-3eebfff578eb", "value": "T1B774613AA5EE68F1CD19A1F9A865CD1941E27CC4EEF68D6F07802F254F2B24025F758C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651356788, "uuid": "3326f1c4-dd8e-4010-b9e9-e3ac5f9fcd03", "value": "7a8eae48cbeb9b498cff13262d717430", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651356788, "uuid": "596c5bcd-f24e-4ac7-96e3-7de7ad31ce90", "value": "6144:3qGa+YH3K7gXppZo39EeKd5htWgN6DbauSU4Ko2qYyw3MURU:aGalH7Y1KHh/6DplPyw3MUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651356788, "uuid": "76fde780-3414-4d65-afb8-c45a6616a8ff", "value": 359640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651356788, "uuid": "851a016e-933b-43df-9ac6-15b9a2d706bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651356788, "uuid": "3d870333-a755-41c6-bd34-05a806915884", "value": "emotet_exe_e4_c6ab69fd16ac66a1085f20eec1a41c33fc1f03eb0253486db15569f32f188702_2022-04-30__221302.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c848d2c-c872-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651315404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651315404, "uuid": "957c3202-e58f-44f1-ae94-e2e92cb179d6", "comment": "Malware payload (Heodo)", "value": "59dbb71024852fdce5aec0274e85986f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651315404, "uuid": "f666dab6-d9db-4768-ab08-99d2085afb99", "comment": "Malware payload (Heodo)", "value": "c6be2a2532baf97fdb1b55174264f81d648d4b02ec09a0b5bd4f3fffe7ecc585", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651315404, "uuid": "6fdc1ab9-2377-4f76-a65e-88520e637af0", "comment": "Malware payload (Heodo)", "value": "6fc1b4baff42be56cf4678f81464a5af444084ed", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651315404, "uuid": "608ad11a-8c08-452d-bb2f-2e73d89c169d", "comment": "Malware payload (Heodo)", "value": "abbb612df790e2c99b1a6812718ed8945262a33f64510062545d1f48ce624829a2c8687bef19a94d28bee57b5b55dfc8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651315404, "uuid": "27a3c868-8d7b-42b9-b0dd-f1b8813dd377", "value": "T1E9C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651315404, "uuid": "6b3a55b8-3b9e-42d6-82ff-36728729ed85", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651315404, "uuid": "4fac66dc-1745-422b-a49e-143c71d0a2eb", "value": "6144:JhZ02GdOOgPYAKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfLKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651315404, "uuid": "84331aa7-c5a9-41c7-a72d-dd3945a312e2", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651315404, "uuid": "01ae93c2-788c-4b42-bda3-b8528dc667df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651315404, "uuid": "7e373536-aab0-4f0b-a5b2-a8c5cbd784f6", "value": "59dbb71024852fdce5aec0274e85986f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "029b0737-c830-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651286906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286906, "uuid": "21f14676-6e1b-4f49-98e0-cdfa54c083ee", "comment": "Malware payload (Mirai)", "value": "f745ba887a178be3b10316a42287c4d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286906, "uuid": "b4c5d359-30ff-4548-85e2-b73d85e0b22a", "comment": "Malware payload (Mirai)", "value": "c753fe71b03b55add6a91ce84c4bdb27ff6282ed9d30a9e7e2702c791eac09fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286906, "uuid": "4c98daed-cb4c-49d3-88ea-87fa1c1d5275", "comment": "Malware payload (Mirai)", "value": "d367b989ba88450e5251a94c5b0dea5af829f8a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651286906, "uuid": "e521a05b-8e14-4a63-9c76-96e6372c5f0a", "comment": "Malware payload (Mirai)", "value": "a9eb5f295d11f3adc3c74117ab8fa035db413a61b33741c6470bebb909b7804dad77c879c65ba4452e313f24cf27ac77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651286906, "uuid": "c98fa1b8-6487-4de1-8fc8-af1fdf980b4b", "value": "T1C643884D6F715FACFFAC863447B34A10924833A527E2CA85E19CEA015E7034E745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651286906, "uuid": "6e2e1dfb-db34-4664-aed9-5ce207eb68b5", "value": "768:va2nEg1lClYj4lhEAwM9hJd3BHXYo14gdUSMVibizAb+UfTVibkDfzFaMGyIBS4r:/ZClG8/9hPj4gdUSMVibAAAbuBvN4/Lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651286906, "uuid": "d50d4b23-f1c8-46be-9a4d-09f557d01b67", "value": 59576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651286906, "uuid": "180a86f8-7e34-4e6c-9ee4-89d1d7ad099c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651286906, "uuid": "fd0706d2-e70a-4a0b-9949-f56f70c8e425", "value": "f745ba887a178be3b10316a42287c4d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ffa84c-c851-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651301220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301220, "uuid": "297243a3-5e4a-446a-8dce-281d5a80d043", "comment": "Malware payload", "value": "f9d635d6a2065b3ec7efcef50cc66d5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301220, "uuid": "8602bc72-ec35-4d42-84df-61e2c0e036b5", "comment": "Malware payload", "value": "c7d80c801ceb5b323f199baf36a2f4a4495e3bee13a0c84cb8f53095dec4f0a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301220, "uuid": "97b9a4b6-7b74-4c4d-abd5-f225fe5aecc5", "comment": "Malware payload", "value": "b8306fec53e92fd52cbde4c7f4689d21652444af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301220, "uuid": "28d0c0a7-0482-443a-95a2-4e1dec0024a3", "comment": "Malware payload", "value": "000973689967aadd11a48b71b1991eca82c7fcc798c9d358f32f0792778ceec733da535e49d6fc9bc692a10e7f5f356b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301220, "uuid": "53c6ce27-64df-48f6-a9c6-00570cd80484", "value": "T186051742A3F5D085E4B21B30DD3E85F86A267E15ECB1864F1694BE2F7C71A10C865F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301220, "uuid": "f9068a1a-629c-40c7-a831-900167022ded", "value": "d30dd5a524ad53558edc1d2f9b7af9fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301220, "uuid": "2479913b-1cea-477d-9e59-1d3c9e47c9b3", "value": "12288:gv+DuAn2TtlMzdc+Inlb5ZmYUYpGmVDoMY:gWCAn2TtlMZeljpGmhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651301220, "uuid": "2bfff230-b61e-48fb-a22a-5772f45491d8", "value": 865216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651301220, "uuid": "c2fd9db1-9856-4920-816e-cbf096bf04de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301220, "uuid": "a29a85b0-a852-43bd-8dbf-39f06392f37e", "value": "f9d635d6a2065b3ec7efcef50cc66d5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d13cd213-c894-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651330203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651330203, "uuid": "8a02b1b9-6af1-4207-90e3-51dce4485ac5", "comment": "Malware payload (Mirai)", "value": "ebc66585181be0da0bb2e6c9c0bdcb91", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651330203, "uuid": "2f76e690-2bad-4e1b-a07f-5508fd36338e", "comment": "Malware payload (Mirai)", "value": "c9348f3a73b8ae985274898564b439a5cc3c84842a08e8fd88d32f500c0161af", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651330203, "uuid": "90555593-2f82-4d84-9f93-8040d2a7bba2", "comment": "Malware payload (Mirai)", "value": "95d942375a534dd09df86158b13126cb1bc6ebae", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651330203, "uuid": "759298b5-3dd1-4728-afc1-0b8f13747d0d", "comment": "Malware payload (Mirai)", "value": "c8c5184526578c4895aee12c3aae77459be408cc9ad525995c094afdaeb0da1be436c163d0a9b7810a5afceaf3f1eb6d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651330203, "uuid": "a4314692-12fa-4bcc-9dc4-682dc717c182", "value": "T121B2F14DF76D4E87D1814336631F436FB327747F869AA68009FAE5ACAB00C5AF861C09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651330203, "uuid": "89682492-4ff8-492c-862c-19740e1dc19e", "value": "768:Xc4VTqxufVlHM3E4YVZDM1YIxywkNMg8YW2:Xc4VTqmVMJdxBJY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651330203, "uuid": "22cdfea5-9d1c-4302-a08b-1d75573bda06", "value": 24756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651330203, "uuid": "d03819cb-e752-4339-a1b3-4e26794045c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651330203, "uuid": "9a7ea37d-9d87-45bb-8efb-db0ec190dd0a", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40cef55e-c83d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651292594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292594, "uuid": "ce0bf182-8e52-4a8a-a479-58b200fc6cc4", "comment": "Malware payload (Mirai)", "value": "af7fecfc6ded65b6195b92681138b4cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292594, "uuid": "a08b8d68-4263-4b02-84db-7b8e1f401f28", "comment": "Malware payload (Mirai)", "value": "c9508c1fb59b004e38cd11cbf9ee8dc33c8a6e835965b23158607a7d2c15995a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292594, "uuid": "a10cf1bc-a7f3-48f8-ad8c-0ec32d363aac", "comment": "Malware payload (Mirai)", "value": "bf8303a9add2cb961230e6ab286726e773417394", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292594, "uuid": "b79b2fe0-3b91-4d99-8386-2a7125660b65", "comment": "Malware payload (Mirai)", "value": "950baae6ceadc1d9d075f76ed050235344fca134406ae1d0f213aa6229b1f2b860fd09a91d3422bf8e64501e6f17d0dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292594, "uuid": "3ac052cb-cd1f-48d2-af56-b642a5e64c82", "value": "T1C8735BC4E1C3E8F5EC111938307AAB729E77F13E7139DE9BD399A1339941202E60625E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292594, "uuid": "84027531-8bb2-447a-bbd2-b18c49830a53", "value": "1536:b/DYQYs1ZokODich9+15UzOHIt09EfsH18ruUGDKVQSi:zDhzUkODich9cUzk40O0V8qbGVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651292594, "uuid": "2b639158-2a14-40da-aaed-d65e293b30c4", "value": 74640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651292594, "uuid": "616b1040-6551-45dd-8c43-ff70e0de8eb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292594, "uuid": "31e1314d-5fb8-4f2e-b86e-e868a198a898", "value": "af7fecfc6ded65b6195b92681138b4cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e96a5e5c-c86a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651312204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651312204, "uuid": "2d4b036e-2d81-45d2-879f-0b5cae6c4465", "comment": "Malware payload (Mirai)", "value": "b9071ed1c85b2b79ea1a407c84d872de", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651312204, "uuid": "a4764ba8-57c7-4530-9c45-fd22f4506e78", "comment": "Malware payload (Mirai)", "value": "caa4fb0836e4ce340b1bdf84e10393ee765a3b09bf577a448a61f8dc317923b1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651312204, "uuid": "43497ecb-0039-48e0-8d4b-9d23ac0ba5c8", "comment": "Malware payload (Mirai)", "value": "a6f40c7b9a102c1ed069f9f4e6675b078931f697", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651312204, "uuid": "d877bfd9-794b-4729-93f7-532709a95db8", "comment": "Malware payload (Mirai)", "value": "78a5ccffe6d7ecf15ca93b6f9d9608afad08cfe12c0a332e63d04baa1164f84a604b859ddac1f3135fa4410046803aa8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651312204, "uuid": "42fee72d-8b0b-4fc0-a54e-1beae8eafdfd", "value": "T10DC2E099D7438523D4CEC33A826D3FBE69F7FC541F7A99484DC898C50E8B4298E32150", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651312204, "uuid": "73860a49-a2d6-4895-82b8-bddcf8d0777c", "value": "768:IqsF9191ChFj01Qt7/Yu/suAdTXBV0XdwjTrJMQ8:Iqsj191C7fFAdgdwLun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651312204, "uuid": "d1252976-358b-4063-a8e1-d092dfc1c360", "value": 28108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651312204, "uuid": "70f867ba-a5ec-4df3-ac96-e2c86a0268a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651312204, "uuid": "7019b5fd-71ae-4719-9fa2-dc8e586c53f6", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9204f6b-c868-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651311318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311318, "uuid": "ac326838-bc3a-4706-9622-61cee1a2c085", "comment": "Malware payload (AgentTesla)", "value": "ae1ad7753f9f115a63a39cdf57feb14b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311318, "uuid": "766d313b-c4d7-4f50-bf5e-f149e3b12e03", "comment": "Malware payload (AgentTesla)", "value": "cb7282d76f6ef55d98466837a204eaba8fb36b3e8912ee65a5ffcaf453e52da8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311318, "uuid": "deb243e8-f6d0-4156-a1d4-1c06e86ffc0a", "comment": "Malware payload (AgentTesla)", "value": "812c8c24c8b52ac3ea3f08cfc99926515e8d6e74", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311318, "uuid": "33d2f56b-8e4f-4172-9e7b-17c709303784", "comment": "Malware payload (AgentTesla)", "value": "c72d712ba9507a8c9f0661d290d4b3f643d81f32e45f072fc6e76e771aff45b19d517fdd763ad698e045673cf8e9ae76", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651311318, "uuid": "354d807f-4ce0-4bee-bdd3-cda0331a6fb1", "value": "T12C942324F4C04C5760927AA9510E87EFFA9B9D1FC37AD7C3A1721F49483AE7D2B18182", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651311318, "uuid": "1c3f4c08-aac2-4aa2-9ada-256e5e5ad711", "value": "12288:QSw8GjWAzeLC9Zk+8ivD7ularKncF68pwhSBbvb/XzAEp:QSw8GjW8eLCeOD7DrhMhSZv7XzAEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651311318, "uuid": "68146c3a-e2b0-4d01-9e6a-073c2cd99097", "value": 420511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651311318, "uuid": "b11818ad-72d0-4d65-940e-bd853187c649", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651311318, "uuid": "487f8da0-3e2b-4934-9069-685cddd1edf5", "value": "BL. NO. AWSMUNDAR360621.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06463ded-c826-11ec-8e58-42010a9c0032", "comment": "Malware payload (ZeuS)", "timestamp": 1651282618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651282618, "uuid": "c9bb597d-55de-4ee1-9586-40dcb04185c4", "comment": "Malware payload (ZeuS)", "value": "780e816bd8acc8859a96bec44182b0cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651282618, "uuid": "ba7a9054-0963-44ac-9747-7ada6633d826", "comment": "Malware payload (ZeuS)", "value": "cc30bcaa3a0f8c165a4ac26b08e8c061faf042693c9529a53192a529bc4cd9f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651282618, "uuid": "05c9f73f-10d0-4344-a724-fbca56c373f2", "comment": "Malware payload (ZeuS)", "value": "5e515efa066d36ad29ceade422b40d4937105fe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651282618, "uuid": "8538d3a8-5817-48f2-8e5e-6ea3051297c6", "comment": "Malware payload (ZeuS)", "value": "b41bff7275c01fb7aa627167909cf5fa238571722b8db77dc8a412e5da1d5538c57e967ce0818d47872be0097cf559a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651282618, "uuid": "779754f0-e5b1-442c-940a-bc7d4e38e1cd", "value": "T144936CA1E3E2807DF8F756314A710667DEBA7D102A35D21D96E24B5D0F32AB0D43A393", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651282618, "uuid": "f4e0483c-abdb-4f13-a0f3-701d8342e850", "value": "1536:jB97/WIHGlSMft1kRqIrQf3QeiswNQwfpZZxguJWr:jB5/WIHGff6bsXAQwxx3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651282618, "uuid": "c049e0c8-82af-43ff-a22f-a55d4cc911ab", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651282618, "uuid": "1b276f39-f344-43a0-8b84-62bc024bddfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651282618, "uuid": "954a0962-d58e-4176-9acf-7026ef864d18", "value": "cc30bcaa3a0f8c165a4ac26b08e8c061faf042693c9529a53192a529bc4cd9f8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22b1e98-c856-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651303549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651303549, "uuid": "feff5f42-f909-4000-b712-12bc0fcb416e", "comment": "Malware payload", "value": "8c43da117cab916b3197ee79f3b0d6f6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651303549, "uuid": "72afd437-2bc4-4a5e-8fe4-fab1dda8055e", "comment": "Malware payload", "value": "ce8899d8d49652029aa25de054867af23fc717a06962e628aacff513848d9c46", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651303549, "uuid": "3dd74e59-7b4c-4596-8150-af19775b2c6f", "comment": "Malware payload", "value": "e35fdf55057d714c59cbc84bdc5b702789f91af4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651303549, "uuid": "10b921f3-a54e-462a-80f7-c20839f9fe4f", "comment": "Malware payload", "value": "10ba1404ed3f70637f4e5853bd54ee9c73d06ef8ba68a864a5177948a0cc4d958b5f6e5468fe4332ff0fa901334958f2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651303549, "uuid": "1087759b-c970-48d1-a89f-c099d39bbe29", "value": "T1E2D46B4BFA6C80B6D0769138C6539B4BE3B17C504B60938B43A1EB7A1F777A15E2E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651303549, "uuid": "107cb209-cf3b-43e2-92be-6d229e70c1d9", "value": "197d9b9439eab515b09edee36544d57b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651303549, "uuid": "5277b161-e8e1-49b5-8b99-0c23d8d52d29", "value": "12288:VMeQsno2LR+eTz4kMJFGH6C7Fj73Whmrkj5S3u49am:VDftXegvN7WhmIj5OuuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651303549, "uuid": "e1c6f342-3186-490f-8978-433b88bf6200", "value": 625624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651303549, "uuid": "25b34e3c-8a3e-48dd-9bb8-275e0def14dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651303549, "uuid": "c9334b45-5918-49a3-af17-069e899327ed", "value": "emotet_exe_e5_ce8899d8d49652029aa25de054867af23fc717a06962e628aacff513848d9c46_2022-04-30__072544.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b33428-c864-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651309625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651309625, "uuid": "d4f82a6a-38e5-4e43-a060-9a6bc76239f2", "comment": "Malware payload (Mirai)", "value": "1e0e1a4d169ec60b150ce920a4d0eda5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651309625, "uuid": "2d49d40f-af6a-4bc3-a074-0b4fe7392020", "comment": "Malware payload (Mirai)", "value": "d03848275d8bff7af3e8ac66ec6464c020b3207a40360ab630f27204ecea08f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651309625, "uuid": "08417dca-ac27-4043-967e-fbe9b2ddeea3", "comment": "Malware payload (Mirai)", "value": "10d71bc9a4b28ff386012bf9f19396efcf339871", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651309625, "uuid": "ea7873d6-e2d9-4e1b-919e-e944e2748e84", "comment": "Malware payload (Mirai)", "value": "8a991cb860a14c82b67e265cfcf3ac8669670ca9b34aaedf01ab4271d749d217ba100f6b8c7b1a210b71dad4b405d480", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651309625, "uuid": "0827f159-ac92-44ce-a7ef-a4e7c966533c", "value": "T15BF2E1202A3A4852C660053EF49E4BCD9F52EBF4C8EFF467610ACD5C76AF1440ADD59B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651309625, "uuid": "6ef42eb2-67a3-412f-bbdd-d22e553ab935", "value": "768:tm+hBN4sfu6uKfUe0BggkNeCojNtfO2ops9q3UEL4x:gWN4gu6xfE2gkUCAfOV1Lw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651309625, "uuid": "f0db98db-c9b6-4ded-99c7-dec28936b6d0", "value": 34876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651309625, "uuid": "c27c3be7-11fd-432f-81da-3625ee0334e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651309625, "uuid": "cbe98ca5-6004-4fc8-bf30-a179d41d8f1f", "value": "1e0e1a4d169ec60b150ce920a4d0eda5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb15338f-c853-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651302248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302248, "uuid": "ea917ea7-12fc-40d2-9f86-ad687e21db6e", "comment": "Malware payload", "value": "ef70c103115b787dd1219634769bc438", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302248, "uuid": "b7219d0e-f13c-4eb8-9f70-4459c9bd57f5", "comment": "Malware payload", "value": "d0997c1d5ec51345d869dab0be96b7677596e898f7d4b34b338337948e2948c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302248, "uuid": "4f7a9a88-7c17-46e9-91fd-ea654e3591d1", "comment": "Malware payload", "value": "18f48a2fe8a2c36b93b972b25503e248f56ec6d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651302248, "uuid": "459ad21b-e51f-4c31-97dc-10143a25f84c", "comment": "Malware payload", "value": "405df32df16fa0ee0c78b58ed6a33ed368df8df44c0d600e1bf5261e141d88e233bda7027f47589fc7efdf7c669ff94e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651302248, "uuid": "15171e8e-c56c-410d-aeb5-b3e05c1001d1", "value": "T1168459036E6CB6C6F96C07BA0862E27177A8ED956D20DE5A1AF03EDBF130705C540A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651302248, "uuid": "1ac57174-93e4-4e87-86bc-d364958e63f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651302248, "uuid": "bd9e9617-92f0-4f2b-bf42-acedb5d1a0cd", "value": "6144:0lEZh+3jfnaLD+Rd11UgxY7GBp5AoZKhzV+QWp+mdh:67aD+Rd+7apyqKhh+QE+oh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651302248, "uuid": "9f59e943-27c1-4990-b930-569eaa249a85", "value": 396288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651302248, "uuid": "63590903-f9fa-42f6-855f-b9fd043d3c37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651302248, "uuid": "18416ddd-f8ed-422b-81eb-4fe71f4a3a5b", "value": "Nueva orden de compra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d97dcff-c84f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651300347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651300347, "uuid": "9fe16406-e94e-4133-8a2b-855e96a4670b", "comment": "Malware payload (Heodo)", "value": "5cff248b9682f7c3e4356649453c852e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651300347, "uuid": "2dc7ab5c-4759-478a-957b-5ac91c5fe3e8", "comment": "Malware payload (Heodo)", "value": "d0f714d196d1f9d0e05cdd5a097080e4170d299bf822b54ede57d320315726ab", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651300347, "uuid": "ef2cfee8-3a4d-4709-bd0d-c9374a45cb30", "comment": "Malware payload (Heodo)", "value": "091f8463b9a0ef3daa4d4950d6cfe464fcc979cd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651300347, "uuid": "7ac497ed-b6a2-4c21-bd1c-7fa80379562b", "comment": "Malware payload (Heodo)", "value": "df18dd45b1002d593a1512bf03c327c2f9c0ed4d1ddc1d7f77348f841abb0a14db6d9d8e3457391acd7e3b89790c7d7f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651300347, "uuid": "aec79cb1-6717-458a-92e1-f866388e9b2e", "value": "T14BF35B14E5D305F7E8E70572500A7A9FE8743845A614CE7B9654CFDABF20B22A21D32F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651300347, "uuid": "ccd18b79-09cf-4015-805e-27fce0bab7b9", "value": "3072:nWq0FAEmWR7lapxNQcH8VzvYykSRYPCSknzuTz2154MkkOYib:WxWvdp40o9ICZzK61O51v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651300347, "uuid": "fbcf8c65-c79e-4ed6-80fb-b510c6e922af", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651300347, "uuid": "3b405f51-cb87-41dd-8bb8-d2d5dcb88f65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651300347, "uuid": "a0c8d0a2-53f4-41d5-92c1-ef7773b38935", "value": "4e1baffe4077e80646285ba6d797ae304ea2fe089528c618985d39637dc8fe43_unpacked", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c99623-c881-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651321864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651321864, "uuid": "c0335ca1-7e65-495e-a023-bc530b5c1b79", "comment": "Malware payload (SnakeKeylogger)", "value": "ad67adbc887b5046948151079c0e49f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651321864, "uuid": "eba6f68b-6074-4a39-a06c-5261686f93b8", "comment": "Malware payload (SnakeKeylogger)", "value": "d3f773f7f124b293bdb4e186c41fda4feb669f4deac1620119c96400974789a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651321864, "uuid": "8235cd08-19d7-41bd-a61e-f9b9ed7c6546", "comment": "Malware payload (SnakeKeylogger)", "value": "749ae5c69c5610ff79a6d905ad57d5d8e65eec57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651321864, "uuid": "bd417df6-9db3-4bb0-aea8-e5d6fd3eb334", "comment": "Malware payload (SnakeKeylogger)", "value": "64d303bfdb8ebb7002bbaac510dea8d7bccd65a7311848c818fedfa0c37d0f6a725dc1f46e9e7a530402b3db1b2454df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651321864, "uuid": "4556f86c-dedd-4e88-8f72-5e9ad53f50bf", "value": "T19B553A4D1A4E891AEE418A3FE4F2A783371BD7B88C51A70713A5353DE8273AD2F44B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651321864, "uuid": "2affcfd3-1c11-4360-9b27-9fc64fe33816", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651321864, "uuid": "a05a67da-3877-4ece-a445-427579a88cb7", "value": "12288:iaAlbV/aXnx8dv9Z/XV1ZjSbNTnj1/WGjL85EO2laWcpc64u7T4f8435+lx3TVNv:uZAQ7XLaNTj1bQJFrpcPu++lB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651321864, "uuid": "e3a2676d-3aee-46e7-a336-5b242c807bfe", "value": 1337856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651321864, "uuid": "70ec0dec-4578-4250-be8f-043f1e0975a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651321864, "uuid": "c69409da-18e3-4b9d-ae83-dddfc9549e21", "value": "Sign Copy Auth Letter&BL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb57715-c877-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651317631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317631, "uuid": "b0df830b-bea1-494e-9afa-216ffa3767d7", "comment": "Malware payload (Formbook)", "value": "4e86f31132121f187a8968e63ff25cd8", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317631, "uuid": "c7f5cdf0-fab4-4e4a-a219-13d69c72d2ff", "comment": "Malware payload (Formbook)", "value": "d53def0461e8160d10039ad740e81a2548973261d0cfc874b9a5094bf818f3b2", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317631, "uuid": "304e61a0-ee18-40e2-b7f8-4d2f99dc9d9d", "comment": "Malware payload (Formbook)", "value": "5a65660e0799139c987bf519f34b8dafd8a95675", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651317631, "uuid": "f6330865-dda5-4fc7-ab37-dba12b994463", "comment": "Malware payload (Formbook)", "value": "552929eb77c707a1ccd46d4833925770ac2c4b1d6ef542e37d3a3fe63fd2d0d5a5461f15a78611383f705c9af9b66bbc", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651317631, "uuid": "4ba6fc69-ec22-43a6-857c-8d4a9fce6f57", "value": "T1DD94239C625483DC4F68EC822995B2F23D7B211457EB8E4106DAB135F41C0BBA97A3B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651317631, "uuid": "6f4dc257-3666-4d92-98fe-ce81d9bebbcc", "value": "6144:WKRcxcwiQ8nX7JSYAHaE5NXHLKq4VRg1ULZcsIemPY1AQkdRrFJ9EKpPm1SihqJB:0cw58nX7YYAz/HLIZdnkQkrdKSihqBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651317631, "uuid": "10bfb27e-44bf-4f14-86b9-061a06a72526", "value": 447935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651317631, "uuid": "e75bf5af-bb6c-4d81-8828-9bc64e370fe0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651317631, "uuid": "3e58fb01-974d-4233-95b3-1bc848d2e87e", "value": "5544682.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9596ecd-c8ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651346484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651346484, "uuid": "4e5bbc33-9147-48bd-bfb0-d8cfc2e33806", "comment": "Malware payload (Mirai)", "value": "ff60a2cbefe7dcfd05d027d33376702d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651346484, "uuid": "3caf2b40-8e7f-47d4-b81a-e0ce96cc31e1", "comment": "Malware payload (Mirai)", "value": "d79d318c0302f0434938cae3d8cac98bdb4f318b3f1cd512c859a63e9fbf4914", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651346484, "uuid": "ae0a779c-2ae4-486f-9884-5652533f62cb", "comment": "Malware payload (Mirai)", "value": "98e60ada12a3155e8841cd2b2cd52cc5fbcd19f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651346484, "uuid": "ca10a250-c6e0-4d29-86a2-08fc98b7fd2f", "comment": "Malware payload (Mirai)", "value": "df481613ada0aee23bb29733d020c70e670e51edec3be0bba9fa7e70c3c89c90c7d062b7071b6d671cf571bcab6c20ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651346484, "uuid": "93d08d96-3c07-4d00-84c6-e4b44d42e445", "value": "T11DF2E1B761C631F1D3B42D39FCBFC19B518A1A3DD5FE38A66114D36A1AE325882E41C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651346484, "uuid": "fc1f0681-9f8a-4cb3-ac27-0c677af1678d", "value": "768:CVO9iBPm2A0KsAdbX+pDf3GibMCLKHZ4+ZQy324zZ/T2q3UIZ1:CVO4Bu2ARHdbX+prFbtLAG+ZDF/TZZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651346484, "uuid": "9de3536a-ab4e-4361-b73c-c5b89f56caa3", "value": 35220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651346484, "uuid": "4153b213-42d5-4601-b4ef-3d947fe4ff83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651346484, "uuid": "6126811c-2e86-42ce-979b-c2b16110777f", "value": "ff60a2cbefe7dcfd05d027d33376702d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f9a754-c833-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651288227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651288227, "uuid": "a0c81f81-f3bb-45e8-98c0-0efb460fbc59", "comment": "Malware payload (RedLineStealer)", "value": "3253df39a04c0d28145b6d7534277f05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651288227, "uuid": "1cd11534-7e9d-4e01-9f13-30ffcd7365fc", "comment": "Malware payload (RedLineStealer)", "value": "d81d5f7e16e9f2e0eccc0c65c3d71781d73b6640f9e6c0cce7e50458cb545c3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651288227, "uuid": "15c1baa3-1a01-4088-b896-7275be140cd8", "comment": "Malware payload (RedLineStealer)", "value": "43a014e73a7fd1ee883d6c4efa38f7e3643a3c87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651288227, "uuid": "736f8173-7532-4814-a13f-4e6804c466c1", "comment": "Malware payload (RedLineStealer)", "value": "dd8aa769489e78b8c5e148d30ef07c8d71bd325725ce6ac0b274e0e23d4a42203cb86bf9cc784ae6fce67f73053a5644", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651288227, "uuid": "9bd9e1c6-02ca-40da-8b40-6acb449520f4", "value": "T1E005C0D07C52AE49DF831FF50561F728A7BE2FFE1AD6E818F920EB49F4329902109915", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651288227, "uuid": "2cc5ebcf-2c0a-418b-bf4f-fb227b19bc3c", "value": "0ca1086ed6eee177a87646b0229f08c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651288227, "uuid": "6aac2f73-2558-46c3-9008-b16a80c265ab", "value": "12288:6q4IxNFrja3zwWKRqRr47TPqwGrOnpwU6gHHs1vdnrz:6J0//a38W6orCTJGrF8s1vd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651288227, "uuid": "237eafbf-c9f1-40c7-bf56-4a568eb7b136", "value": 825792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651288227, "uuid": "db1e9050-0889-43b8-bf08-c524e7894744", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651288227, "uuid": "37f2d5bc-d5c2-405c-80a4-16c565b69c1a", "value": "D81D5F7E16E9F2E0ECCC0C65C3D71781D73B6640F9E6C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7418bf5-c835-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651289384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289384, "uuid": "60721e73-7869-4ced-8529-9fd9209e192d", "comment": "Malware payload (Heodo)", "value": "6d1cc205d1005609893671c0d07ce917", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289384, "uuid": "55cb89ef-163a-47b6-889f-47e8cc8b40fd", "comment": "Malware payload (Heodo)", "value": "d84825b0c2ecb9c2bbf8a41c4156f1c562b87f680a1dc44830dac19f5703a306", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289384, "uuid": "cb12b387-5481-4e64-a4b7-129b5c770f9c", "comment": "Malware payload (Heodo)", "value": "90899c5050773593662a0c8d6e1d9477e95eaf1c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289384, "uuid": "8e55fdac-f46f-40a1-baf6-8788c1d8c092", "comment": "Malware payload (Heodo)", "value": "638bfae748bd3798dae0f5c3d0622db04b20b262eb07b3bfa570599371c0e0e5d6a543b53c623503ece5e8c55b11fedc", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289384, "uuid": "f6404d65-b0b7-48d7-8053-5d60b9de6c3c", "value": "T190C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289384, "uuid": "6fc05fa9-5e7f-4462-ab01-25a7d2e00ad1", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289384, "uuid": "bc4c6d6f-fd2d-48f8-a78a-25dda1e3c995", "value": "6144:JhZ02GdOOgPY0KUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfHKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651289384, "uuid": "1155c404-55dd-4f45-964d-f0d7c13292f2", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651289384, "uuid": "0ff476c2-1885-4d2e-a48d-a248997e8096", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289384, "uuid": "ea1b7254-7200-46a0-bcfa-9a506474fb34", "value": "SecuriteInfo.com.Trojan.GenericKDZ.87125.5850.16817", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b380c68e-c8ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651346474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651346474, "uuid": "3bc758ad-b173-4003-8bdb-157f608fe1d3", "comment": "Malware payload (Mirai)", "value": "cd14b6ba2f710944e0e73780aa6f0730", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651346474, "uuid": "d0166332-1526-4dd0-9636-2e6637b03439", "comment": "Malware payload (Mirai)", "value": "d902bfa0eb9d99fe2db8e25095aa97f71227cea6e9091171acceb553d7d1ce58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651346474, "uuid": "d6bcb25e-7fe1-40e7-b166-273989446040", "comment": "Malware payload (Mirai)", "value": "e51bac28faab1abaf5f3f28f5d9380038ad178bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651346474, "uuid": "f9211f16-f246-4609-8624-94b3779d22a1", "comment": "Malware payload (Mirai)", "value": "c0324b508c48c9054cf062fafa5437008e557495403658cf303d081a8f4c208f3eb08f6637d445242d27007467802fd6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651346474, "uuid": "810f6714-6b43-475e-9e45-26e620ab62f4", "value": "T100635BD5B401AE7CFA5FEABE84214A0DB531B74051A30F3BA7A7FC936C721A49816D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651346474, "uuid": "7d6a31ac-a4a9-4f4c-acd8-a80ddf427f74", "value": "1536:8i0W0YSxyvvEZve6FwxYoNUuVMFyyQR3gggTqC8Ask:SxyvvEBeCdo2uaUPfg2nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651346474, "uuid": "bae2fde2-b104-4f78-a0bb-c64ecdfc6606", "value": 67592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651346474, "uuid": "b75f280d-9f68-4947-a156-a33285615287", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651346474, "uuid": "aa40ddf3-a0ea-4bf5-860a-06ae3b111cb5", "value": "cd14b6ba2f710944e0e73780aa6f0730", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f78b8ff-c89a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651332669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651332669, "uuid": "e38a6a06-a739-4a47-b25b-04cdf32726c2", "comment": "Malware payload (Mirai)", "value": "052f68de27e26d4c9d69197256794595", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651332669, "uuid": "c534cecd-b07f-47ac-b645-b4e5de536694", "comment": "Malware payload (Mirai)", "value": "da02388528f3ea5a32b216caa6f1a0fb02b4cfb478a93f1eaf41d20bd73b8905", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651332669, "uuid": "8811890b-b4af-4b82-8b21-ec35b0d8489f", "comment": "Malware payload (Mirai)", "value": "52a763c99081c99f5141496ca9f497396f941ee0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651332669, "uuid": "21d1fa44-ee23-4026-91c5-acffda9230d5", "comment": "Malware payload (Mirai)", "value": "d869d272e96b6661fa03187846106fa2be10e84d86785ffe5c45a0c3679f536faeacaa2d2a24e136446929e8afe00f51", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651332669, "uuid": "e7817763-a1f5-4902-aaa1-278155827061", "value": "T1EE337C64D46A9DACD1064AB476288EB48B22E0C0D7477DF6A720C3A99053EDEF154FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651332669, "uuid": "de01fe2b-bf67-4f49-b297-623230c613fa", "value": "1536:Ka88Lb7SEJFOfs3IbYtx/qv8zthypvNLOOll8INSNC0gGo:Kr8LxGf+IbayXl8IM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651332669, "uuid": "117d4826-3e4f-4531-b96a-c35178f6fa22", "value": 51668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651332669, "uuid": "02d93ee7-dfbe-400f-8d58-8505bfabf1b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651332669, "uuid": "1699b5f3-5878-4fb0-ab3a-5dfe25197d16", "value": "052f68de27e26d4c9d69197256794595", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7052d36f-c8b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651345932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651345932, "uuid": "6d3967a3-3452-450f-83ea-d2308731644c", "comment": "Malware payload (Formbook)", "value": "317b5a076261040ea5276c79350cdf61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651345932, "uuid": "9d9a7c24-9327-4693-9216-7fb4f1a3a5c4", "comment": "Malware payload (Formbook)", "value": "db6023b35fda173c326a7e6c31a22bce48a0d5f490f2d4dc22f16655dda391e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651345932, "uuid": "66c4da7d-bcb0-4681-9cb1-fb1f9dc0b126", "comment": "Malware payload (Formbook)", "value": "e6f9363edeb8655943231072850acfd2b8ead69a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651345932, "uuid": "c67b6939-2521-4596-b4a5-d8b2beb75e4e", "comment": "Malware payload (Formbook)", "value": "44924a909e820984670905be2d15171f2143cb31745ec6327055e461fa8f59a0274090064e1aa116b846be55727778af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651345932, "uuid": "b946855f-4f51-46f6-81ad-be2f5c9958f5", "value": "T1AB1412047666C577E0624BB04E3927275EFAA72F3068830F23645F5DBE2AE40D71DB92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651345932, "uuid": "0ae5a304-a813-4c2f-a6f5-e4ed58a978bb", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651345932, "uuid": "59defe4b-8dff-4101-bb15-2585aa185573", "value": "3072:l1NjcVVnLpPunbr8kheAFOnrzdRqQzdRVwHOpQteoI4uFXaMcc85pVKud/Naq:HNeZmdIvbqMRVUOeteF9BQ/Vh8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651345932, "uuid": "3a1918cc-57fe-4c27-b42b-4fddea9f5f53", "value": 197387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651345932, "uuid": "5e38391f-3486-4e22-94ab-d7630a00f097", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651345932, "uuid": "c66d9167-c263-4c83-a0c2-66ea3e71d6a3", "value": "TT copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7098708f-c88c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651326605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651326605, "uuid": "1c556031-ace0-4ff2-a813-1754b07c2c98", "comment": "Malware payload (Mirai)", "value": "5080078943fbdc8eca502e4081fc28e7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651326605, "uuid": "769a9bd9-41e5-442b-80fd-6a4dc713bede", "comment": "Malware payload (Mirai)", "value": "dcac0d15e7693909022871218d2c5ef59a8403c32e10f3ce51e034d5a324e3c0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651326605, "uuid": "05caaf0a-8c9d-4865-ae39-8e213c07299b", "comment": "Malware payload (Mirai)", "value": "b533e708868d504260e3354783f5c5755ac805eb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651326605, "uuid": "d42cd9c4-1ae7-4e35-b834-8b9e1442f4ca", "comment": "Malware payload (Mirai)", "value": "eeba30582a2245449b9c042ebb20f5e0c90f2df21a8abfb27101ebcda46d99eb4fe02a8b112ce27da945253172a9e008", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651326605, "uuid": "947b34c6-f78d-44b2-8707-e8d42a8f0737", "value": "T17A034A95FE814A13C5D212B7FB0E439C7B2A4358E1EE3303AE2A6F6177879160E6B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651326605, "uuid": "2cf894de-1a1a-4808-acc4-0b53e1db2e4a", "value": "768:EWZknqWcuN5HriZLFMYucp64kVDKj+a1naZyXiI:LZMowYuLJDKia4Z4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651326605, "uuid": "4c1441a8-96b1-49fd-9560-7696ead44037", "value": 38236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651326605, "uuid": "71125e4b-c4f8-4d7c-99b0-0c4de4f8bef1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651326605, "uuid": "083958f2-42d4-48aa-8ff2-c830d72b965b", "value": "beamer.arm5-20220430-1350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e8055d6-c835-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651289128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289128, "uuid": "5149299f-fd62-4e18-9184-240d95602516", "comment": "Malware payload (RedLineStealer)", "value": "72d1cf4a7588b410090c6a1207a43542", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289128, "uuid": "d9f3bab3-c8f7-4e34-ac38-5a5d013cc6b9", "comment": "Malware payload (RedLineStealer)", "value": "e0568ce2ccf0bcbc096d4cb9ac2599e6697202e39af7806c982aa29fdd00395d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289128, "uuid": "b2ee0036-05b5-43a9-b738-7581dcfbad15", "comment": "Malware payload (RedLineStealer)", "value": "5b1a6bea2f0a692ff2c39fe79a101007bd46b745", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289128, "uuid": "179986d3-25fb-4055-978a-73c140ef7f1b", "comment": "Malware payload (RedLineStealer)", "value": "a8fd6a422854f296b7acea5abdecf8fbaddc21755bb47212900db5d49817cb5abbdadf2161d43e3ec06974cdab81f3bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289128, "uuid": "ee6a97cf-b002-4d3c-ae33-c027ce5c9f5c", "value": "T1ED0633343BC050AEF34DB276A5D7C87E7A50C81061EA4777C8573724AF1AB2316639AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289128, "uuid": "3abc919c-5eaf-42b4-8ca5-50c692a2a5b8", "value": "08792457d1d188a13407f8ead074b946", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289128, "uuid": "487cbda0-7301-458a-b091-a0215f82344c", "value": "98304:xU86hh/b789wtnBwbju8SLrgXAzNdU/Rxu35VlG9O8M8v+w:xyXbrn2u8SPgXA5d6uL09bB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651289128, "uuid": "6f08ec13-b476-4abd-9ee4-cf279d8a4692", "value": 3958336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651289128, "uuid": "91e79cfa-8bda-478e-ae5c-4cb9fc01596b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289128, "uuid": "eaf280aa-e1a1-4844-b2b0-c72a0e45e5fe", "value": "e0568ce2ccf0bcbc096d4cb9ac2599e6697202e39af78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d9c167-c851-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651301162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301162, "uuid": "f615ff7e-fde6-4582-aeaa-5d627d82dbec", "comment": "Malware payload (AgentTesla)", "value": "a55f136f0c82b2925e16617d89c0ebca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301162, "uuid": "64c665e9-b917-45ea-8af0-14eb6bc3ca8f", "comment": "Malware payload (AgentTesla)", "value": "e07d692ffdcd8bdd2678459b75f0281d98169296c8698b19f316ed0adedb4c0a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301162, "uuid": "747cbdcc-6e51-4e41-9e73-56e681dc498a", "comment": "Malware payload (AgentTesla)", "value": "eadce80cbaa9f73a0d62c4604914ceccc5a1f2f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301162, "uuid": "ea9ab2f5-dedf-4ca3-b133-265e23a80dd7", "comment": "Malware payload (AgentTesla)", "value": "c9ebd163dcf3a8ad28b3c76c4c97b755353a710e2ed9fb9075cde8482166f7e855066b89cdabc23f76095fe9ce2b791f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301162, "uuid": "daa6a24b-52b3-4706-8b26-6a93d8b6b8f9", "value": "T14E94236D5FD992F9B7AD7C7205A45F8A3A92F7C78E0089CF53978D4B86EC04624408F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301162, "uuid": "a5b1f824-6e14-42bf-88eb-a698a85bc3a9", "value": "6144:3HmzKoRhAK63uNZ4u8vrlnQHxNHKsVEefIGpF942pn0c8dSsrW20Hwo7tMEdS7K1:Wz/QJ3NnQHBVEO94gqrrWFltTM7nc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651301162, "uuid": "f023cb7b-1150-443a-b39f-6694e5b01e36", "value": 431340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651301162, "uuid": "18709c06-9044-42c0-bc92-b8b304d0914d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301162, "uuid": "109c0299-ef1b-47bb-834c-362f608e4aab", "value": "SKM_C33501911075103.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e178ea-c8b5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651344089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651344089, "uuid": "786dba09-c74c-4c67-959c-abe3c3e1300b", "comment": "Malware payload (Mirai)", "value": "e4c6e6ae38e89a008ef8445cf4df0d6c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651344089, "uuid": "1756dd3b-bf4c-4852-9fb4-cf40e066c04e", "comment": "Malware payload (Mirai)", "value": "e0bea9259b0e15c0b13898b0040c29aadd222c9328f715b08f08123549642e5f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651344089, "uuid": "2f8ca75e-4be8-4f7b-94c5-ee8cb4ed801a", "comment": "Malware payload (Mirai)", "value": "96cf170730d41ea55e2e763ccd09a69b0e765bbe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651344089, "uuid": "107f4d63-1a7b-4f7d-95c8-9323cf113de0", "comment": "Malware payload (Mirai)", "value": "4d530d5f85e915684fd38bf9e09f2c856976728b429bd6dcc36adf8682afdd0e35b275c584b49d1049695b2a90b5db66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651344089, "uuid": "c8bdf4b6-430d-4101-8868-b886bdb2e082", "value": "T1D6135B89DAC3D8B5F92249F2207B4F72AB36E56A2065DB46C79CE535FC12602B31734C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651344089, "uuid": "e8495e67-6e33-4f28-a707-3f5965e63fb5", "value": "768:kZIw0CaWgiyYBM6QT1T1Ez8+i7dls+ObQULM0r05PjZ8yUSJI+:kEhTpjEHSIQULM4cPjtUSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651344089, "uuid": "ce483890-b10b-404d-bab0-dfe9485a9a0a", "value": 43088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651344089, "uuid": "54e99c40-6efa-4b38-9bd4-4378a519bc24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651344089, "uuid": "6874c0b5-171a-4927-b495-6f8ca7bd8a3e", "value": "e4c6e6ae38e89a008ef8445cf4df0d6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3def91d2-c851-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651301179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301179, "uuid": "8ff5da98-348b-4b04-8ffb-ee9a284cfff0", "comment": "Malware payload (RedLineStealer)", "value": "a588727f6c47217f1ab2e22db7393ba3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301179, "uuid": "e7b0af29-0263-41b9-9389-89b10703ebb0", "comment": "Malware payload (RedLineStealer)", "value": "e0e6c9618f5e4633e8258bd31eed311b9d9ae1b90942896feb337f5c208e75fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301179, "uuid": "2efd862a-dc80-4501-8d85-1cb9b17e5d6f", "comment": "Malware payload (RedLineStealer)", "value": "04f6df5844bb5b9a2b125a39a0b0597a1ea948b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301179, "uuid": "4a85c5c9-5721-4ca7-8593-e01feae22418", "comment": "Malware payload (RedLineStealer)", "value": "6faef6bbca70111c0f9617a9fb9b2b3dac3f9eaed2bb875a820638dcdaca5c087ebc0dfe43cf77b57e0e609ef23641e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301179, "uuid": "4e457071-d018-49f3-9d5e-87d18bb54a29", "value": "T13606332076B80872EC9968BAD4C2027831C0B4DD57BE4F83A7E672335D12E49DD63DB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301179, "uuid": "ff4990b7-12eb-477e-bd5d-cd30e38fab6c", "value": "ea6ac0817f2b873ef6a4c458b692610c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301179, "uuid": "f2841581-2019-4e8d-9b87-2ac28f6f8728", "value": "98304:yAJszMEuUHEA16huum+BBe/G9M3HznhEKP:XGAq567m+jWG9MXz+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651301179, "uuid": "d555b4ba-c4cb-438b-a897-6fd2cfc5fb5a", "value": 3979632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651301179, "uuid": "30ce1357-7acf-4c9f-ae00-82e5f02a9861", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301179, "uuid": "ea1d809e-aaef-4596-a907-5b0c32e4aa3c", "value": "a588727f6c47217f1ab2e22db7393ba3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8fc1473-c86a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651312204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651312204, "uuid": "47920718-d377-4052-9c9f-6ae569e473e1", "comment": "Malware payload (Mirai)", "value": "c7464d5f8fdcf72f8a504cf8dc8fb30d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651312204, "uuid": "e297a80f-adc2-4102-ba00-70652316f32c", "comment": "Malware payload (Mirai)", "value": "e42e48473e94219410f53ac045b9a8c89c8fb1076ab3f0a21adcdc98f29007e1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651312204, "uuid": "d0665b82-7712-4e04-9ceb-187bd9ae4061", "comment": "Malware payload (Mirai)", "value": "296bb7b230a42197b61870a90cdd4db7534d5eb9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651312204, "uuid": "1efec3a9-14fb-4f34-9929-e80388922c31", "comment": "Malware payload (Mirai)", "value": "5e37317baa3217f779b17f1ee47ee3ca59c823a02d4c088de1b9613673077fe5869946b3a15dd4b58106facf0f32aebc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651312204, "uuid": "7840d6fc-3f1b-456f-b7a1-871dbc57a75f", "value": "T104E38392E35384BAF51C8DF1306632A0ADE7923B887A50C3FB5A4D91FD61C4601B7EE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651312204, "uuid": "c4b69e83-25da-4a1a-a7b7-dde514bd9213", "value": "3072:QaunoPS1sXZrgRHk1yWYK7pSHNIvIbWWYvsB:unoqqlgBWYiq64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651312204, "uuid": "0c7a0414-495d-40ad-b1d5-3128d2e20782", "value": 148660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651312204, "uuid": "8042ee4a-38c9-4ec4-9d96-8a6aa5dd4d9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651312204, "uuid": "c5efc171-54f8-46f7-be4f-302b46798d0c", "value": "gx86-20220430-0950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb4498c-c823-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651281743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651281743, "uuid": "d05d3a2d-3fdb-4481-bfa0-8951071452ad", "comment": "Malware payload (Heodo)", "value": "13c37184e13b4b42f38511f5a2d43759", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651281743, "uuid": "a0308373-9834-4642-9fc2-93a9f0c55f16", "comment": "Malware payload (Heodo)", "value": "e52bb9a4be9b5984782c40761bff95902412d741a08d68a078315f4d52e78b27", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651281743, "uuid": "a79638ac-d411-4d22-9b2b-5476c2e85417", "comment": "Malware payload (Heodo)", "value": "9db17ce68d26a2a81009a62612091724a911dffb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651281743, "uuid": "d8aed7ed-275e-45ba-86fd-fd3bef6cc512", "comment": "Malware payload (Heodo)", "value": "eb3c9239999adcca53d69bfc8544711c0cde69057a532ac916c0d7a2ddbf209d76540c9c835ddd2661dea5dee36d5424", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651281743, "uuid": "f0460e53-52b9-4b6c-8419-6182b6b68f79", "value": "T1A9C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651281743, "uuid": "3573d81e-5c14-49dc-9484-f372387f0e0a", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651281743, "uuid": "a70e8a72-012a-4e9a-8c06-b5a2ec0a551d", "value": "6144:JhZ02GdOOgPY9KUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFf2KRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651281743, "uuid": "9a7c90cd-0254-4bcb-8ea4-9dbcecf901fe", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651281743, "uuid": "e646eec5-aeac-47d5-b6f7-71baf10a4446", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651281743, "uuid": "b7b9ffb3-cbd4-4e57-8d4b-a002d3fd7911", "value": "13c37184e13b4b42f38511f5a2d43759", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf9f59c-c868-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651311002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311002, "uuid": "d61815c4-11c6-4246-8f7d-4999e602c09b", "comment": "Malware payload (AgentTesla)", "value": "e24b0d73aa07d7762da7df4e17cab71e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311002, "uuid": "813c70d7-5d86-4240-bc63-79b083c4f3d9", "comment": "Malware payload (AgentTesla)", "value": "e53d4b6f1416e3e7dceea98874ebcc85814c17d2ddbb7ccfc030723811066f1c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311002, "uuid": "7b50da50-83dc-412f-8f31-1d07c1a4a3dd", "comment": "Malware payload (AgentTesla)", "value": "74bd23b2c3be7a8c246c398f23a6f6bed82c63c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651311002, "uuid": "d4d5fe42-c82a-47e6-b3de-89b849d47e1e", "comment": "Malware payload (AgentTesla)", "value": "06614d176a17c6c0fdd727fc5fa1347f8c14c72fcfd9ba4bb2276e289c785ccac5ca60aac5ff39d3c097f44343c30823", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651311002, "uuid": "aa9f83d5-5e0b-4f4a-bb36-38fff3eae566", "value": "T1BD9433751112C79768626B78F58292E182B4CFD16FCF67E109B65E31D0CC2273B899E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651311002, "uuid": "3c49e408-f9db-4448-85e3-98d94fd700b1", "value": "12288:pchUyHgleGJSI8e7a9PTYy0WUs61wrGm8dujAlHTb:pkUwgVSI8e7a9PTYyJ6iiHlHTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651311002, "uuid": "7cb9f32b-cad4-4575-867e-6fd6077ec797", "value": 428968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651311002, "uuid": "4156b0e2-83bc-4824-8f9c-b4006ad479af", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651311002, "uuid": "91a348a2-3c16-4c7a-afa4-5bd8029ea892", "value": "IN02672Q583765NBOM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c3f36b-c825-11ec-8e58-42010a9c0032", "comment": "Malware payload (ZeuS)", "timestamp": 1651282543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651282543, "uuid": "b3c53eff-4fe4-4c2e-acee-1a686ce7b2b8", "comment": "Malware payload (ZeuS)", "value": "3093785baed7d02ab2ea414780ea5c93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651282543, "uuid": "87baaeda-489d-45df-83a8-efd0cadc2fd5", "comment": "Malware payload (ZeuS)", "value": "e56d21df2d2afd91a3dcc7fce9e39a2f9588957d40c04ec919e723bb9b067124", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651282543, "uuid": "9fe55a27-e105-4146-92f0-2ff6308d7ac6", "comment": "Malware payload (ZeuS)", "value": "916929a3907f579bed635fa0a706731a38a4dad1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651282543, "uuid": "89f6896f-22bd-445b-9539-4a730dac7e9d", "comment": "Malware payload (ZeuS)", "value": "13b8905c2674396e610f3369a1f0394bf637aa3fc4e5d4a0fab6ac6e972be32ec01c6c77276becd8f9d27cc4d54abd6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651282543, "uuid": "62026bbe-b98d-48d6-8985-fe8917eb0ab7", "value": "T1CAF3AF12BDD38561EDB24A3145364AE7CA75BE30D976A04E9B027F8D7E311E0D93A383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651282543, "uuid": "b5903164-ca3f-4699-b679-fe3f8094e0ef", "value": "60696d02ae2a2be06726ac5dceab0a78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651282543, "uuid": "568fe2fe-e4c8-4ffb-9be4-fa1bd2d3b167", "value": "3072:ZB/T5Px/Cxh843nX4eEw7/img6ddJb+TiNzjBSpLrI18Ib4Pb:ZB/vCjEw7/o6ddJ5zN2r0N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651282543, "uuid": "48ec9bf0-2c36-4c79-abc6-b424c98c19d3", "value": 158720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651282543, "uuid": "a4a3e745-3d1b-46f4-9a57-64ed416b156b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651282543, "uuid": "1ef9a9c8-6c51-4e1b-b632-9de1fbdf7b73", "value": "e56d21df2d2afd91a3dcc7fce9e39a2f9588957d40c04ec919e723bb9b067124.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474ade3a-c83d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651292605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292605, "uuid": "fe3b680c-ae7e-44c2-a602-9188c0e8fe33", "comment": "Malware payload (Mirai)", "value": "851ac901eeabbccfd71715738889fccd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292605, "uuid": "3af4027a-fcbb-40f9-a665-a9e3e5bbb1d1", "comment": "Malware payload (Mirai)", "value": "e6bd8266a1a788e84eaa7d877ecac2889ffe685c29ed1492dfbd8df026a176e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292605, "uuid": "53105823-8de7-4df0-b72e-028b7f42a993", "comment": "Malware payload (Mirai)", "value": "085e9f6b598c678c1834577ab17389dc8cb4c1dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292605, "uuid": "836c06bc-41fe-4692-86cc-d1fa013e615f", "comment": "Malware payload (Mirai)", "value": "69afc3f6c4f7b23da77f56b7a10e3a56a2792cddfae15132b90d2ab68dc50931bea3b302c1f6fe36c2ff125902bb98ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292605, "uuid": "f40bb71f-014e-4ebc-b0ad-843a78e41b7e", "value": "T10B73AD33D1686DA8D0664B75B9988E309B23A28416933EF6D794CB784013EECF509FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292605, "uuid": "8c987165-b7fa-4942-b2b9-4f725f730996", "value": "1536:9aD/MEGvbwt+i7EhHvcdn8C/0rrnmFWlrKkNGIkFgCJl2c:9OkdzeEhPcF0rjflOkQFgLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651292605, "uuid": "26274a13-91a8-4e61-aec7-fd3f51364a22", "value": 75888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651292605, "uuid": "fff7e68d-27e8-4a5c-8e00-d5c2f74b8bfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292605, "uuid": "50626e93-16ee-4886-ae85-364dc8640ffd", "value": "851ac901eeabbccfd71715738889fccd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8afe0dfe-c89a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651332662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651332662, "uuid": "4b00bf0e-b66b-40cb-a279-67917056dd55", "comment": "Malware payload (Mirai)", "value": "0c18264819a8d97a0b7e006ae7f1514e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651332662, "uuid": "b0ffe134-b317-4a2c-8aa1-f16ac5dc1640", "comment": "Malware payload (Mirai)", "value": "e71b37b58b8826144c787a72c7d3fdded506493ba5f1505b88d789e88b997231", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651332662, "uuid": "c7331991-67b6-4c5b-a3f9-c71c7797dcc4", "comment": "Malware payload (Mirai)", "value": "7a8a55f1bbc4ce14ab31ca6419ed928ff29b9973", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651332662, "uuid": "705cf285-8907-49e5-b082-34fcebc22ba3", "comment": "Malware payload (Mirai)", "value": "78119717fa124ba68cd4f196b80d1b9cda9873a372d6ccc931c3a0a3e456dff10d8a53d4da2510f5d4c5079cb301f7f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651332662, "uuid": "0625e496-079f-4039-99e9-ea8fdebeb8c4", "value": "T1A4B2C0A1C8341B40DEEFAFB42D8565C17B355BCD37E79A8004829B1D426AB7C60CADD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651332662, "uuid": "f6f54b02-78b9-4989-9b06-54490925c362", "value": "384:LVm2lsZxbHyljOeBZ2KHYeb3WolV2UCfIIpQImutEGGQEk2rOXwcP6+SM4uVcqgC:pmEcryb0zcV2UCf/m7u5GQEk3Xf6q4uf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651332662, "uuid": "9ab2e644-4c10-492f-8b72-959db595992d", "value": 24164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651332662, "uuid": "ac348718-9fee-40e6-8fe2-ea402cd03748", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651332662, "uuid": "2c5b4217-bc5f-489c-a2b3-d06981bda92b", "value": "0c18264819a8d97a0b7e006ae7f1514e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b17985-c829-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651284301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651284301, "uuid": "3fdf1d4d-3f19-4d40-a96f-00a465610bfe", "comment": "Malware payload (Heodo)", "value": "4feba58e7a541b82a039d044ad67b757", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651284301, "uuid": "38629e97-c5fd-4af3-89c4-bb35a609b8d6", "comment": "Malware payload (Heodo)", "value": "e7349191b40cbc193ffe36c25c93e2b6a4e6d07fb6b73d4704b002c18b804511", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651284301, "uuid": "80c9d500-9498-4f16-8e67-2e1a7d5ad2d4", "comment": "Malware payload (Heodo)", "value": "c5e012234b8fcba88aee950cb79d868a7d5d6cd7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651284301, "uuid": "872c7597-642a-44c7-9fd7-ed209577d1e0", "comment": "Malware payload (Heodo)", "value": "bac31309f1c543c5bd52cbff81c551a1c8416c844aefa1d8b52f3790b3368287b4e4d79c780e54186577fa7029c7a7e4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651284301, "uuid": "f9a6ff95-158f-4eaa-a086-91c0de37528c", "value": "T1D9C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651284301, "uuid": "ec46e974-5d21-4466-91ad-327e7b0bb517", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651284301, "uuid": "600b6fd3-99f2-4e6f-979a-4d0569406afb", "value": "6144:JhZ02GdOOgPYRKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfSKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651284301, "uuid": "d04ad157-cf1b-4a26-ace7-707f06d20859", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651284301, "uuid": "38774c49-6694-4a84-9e18-97a481a067ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651284301, "uuid": "8ee94e1b-9e59-4b34-a702-074707021f90", "value": "4feba58e7a541b82a039d044ad67b757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a241b5-c8ae-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651341265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651341265, "uuid": "21a58b60-3e1c-40f0-9694-4d9a7a5975c2", "comment": "Malware payload (Mirai)", "value": "aa3addd9f2fdb0a0193e4ea08d2d5718", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651341265, "uuid": "3031b316-b820-437e-b70a-d28d95277da3", "comment": "Malware payload (Mirai)", "value": "ea296903130db2d1c04b3f646575662d7114d535206d638ea83b379814b794c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651341265, "uuid": "a2342ee7-7f2f-4bd4-a243-69a5e95071a2", "comment": "Malware payload (Mirai)", "value": "e4f76ebe566fbeb49fd5817e0a85fd646b97adb5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651341265, "uuid": "a0ee4549-dfe9-4a46-892a-f42804f714e3", "comment": "Malware payload (Mirai)", "value": "b838910f46e845268ffa7779e106a3d1cb1f93529c95c25224af1418192cff0f1941d0df1de81e228549aa51962699b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651341265, "uuid": "99ccc66d-e6fc-45d3-b203-cea54460d741", "value": "T1D8E3E73B672B0A23C0C5547106E31232B9A9EE4834F947D7A9D07DAC9F3D94C346A7E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651341265, "uuid": "938d97d5-29fc-4a0d-8a8f-26714da46dcb", "value": "3072:+NlUaGZXGpd/mq6kNPC7iPHJwDbm9/sduDwAGp+Ng:cHGZXGnfl7PJ0bm9/sduDwAGp+Ng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651341265, "uuid": "708d6f6c-d2ad-4aa4-b078-be4e07ff33b1", "value": 155164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651341265, "uuid": "27f54d3f-f4e1-433b-aa40-e509bdff6592", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651341265, "uuid": "92f6005b-9f79-4833-a2bc-1c4a9333de85", "value": "aa3addd9f2fdb0a0193e4ea08d2d5718", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba5dd035-c852-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651301818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301818, "uuid": "c4fb935c-872a-4ce0-9965-b388454a9a32", "comment": "Malware payload (Formbook)", "value": "b83a21ee947e27847b02ccc07da1b4c5", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301818, "uuid": "9f763704-c95b-46f3-9df3-5760be0036ef", "comment": "Malware payload (Formbook)", "value": "ea2c7d3f804a766afaa10e922e7d5dce071f6c7340f37c7e4d8a857edbbb9615", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301818, "uuid": "b755f354-79fa-4621-b552-8ef2e8095856", "comment": "Malware payload (Formbook)", "value": "b2235daebb9e11d8b8884844735ebff295f56beb", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651301818, "uuid": "81e52913-a3aa-4fab-aff7-37684ef4e950", "comment": "Malware payload (Formbook)", "value": "1324767ffa6301ba69c5ec58769bdcbdad0128ba3cec32a6aa840b320ecf5dbb21a022fcb0a38ddf421e9517c8e914ac", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301818, "uuid": "f8f92528-dcbb-4db8-8642-2ac357af87e1", "value": "T1EA85F88EA30B8546EE408B74DBB76B621752C7B689C15393E395763DD01B3ED0EA0783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301818, "uuid": "3058b5fc-6ad7-4c49-9927-1c2c9851607c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301818, "uuid": "54b55c3c-b906-4f9e-af10-5a82542bd58a", "value": "12288:vRNIRTfb/tJS9p8QCstp2OoLp2c9uCOHv20NGpvoBz7hPbQaW4Xax8h4rvA0cTSv:gTjVJAp8QBUtp0CcO0Upv+hDQaWZTSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651301818, "uuid": "defd9265-1557-404d-ba61-6bb9a13630c7", "value": 1850880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651301818, "uuid": "ea0f8734-3e94-4dfe-855d-73301ad46394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651301818, "uuid": "63d9a36b-706b-406b-8434-961626451be8", "value": "DHL EXPRESS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efeca5fa-c861-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651308350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308350, "uuid": "62075abd-f7b6-426e-b486-93d23bddac82", "comment": "Malware payload (RedLineStealer)", "value": "b31bdf024f2cca1b6122fbf567f2ff03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308350, "uuid": "57c2db25-add6-444a-8f3c-a268177e0a65", "comment": "Malware payload (RedLineStealer)", "value": "ea5d49dda5c737b9fcafeadbad938abecfcffd1c9734127b0c618009c316ca78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308350, "uuid": "7ec0deca-eb21-4742-b0d5-10135220703f", "comment": "Malware payload (RedLineStealer)", "value": "811d15cde9aeec3fec92f529ef47d6405707bb70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308350, "uuid": "bf696f8b-1e63-47be-8cac-7e2c693472f7", "comment": "Malware payload (RedLineStealer)", "value": "b249827b1fcc10926d24c7b15bc116106bee46617951062105edd5cf63da64e078957d1f77c7633e118043d7a6ec2ec2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308350, "uuid": "cc0dbebc-476f-42da-8fa3-7c8dc306f03e", "value": "T1EDA5D0017542813AF9F305B38DB95A9EA62CBC41075664DBA3C93C6E0F799F13B36C1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308350, "uuid": "f1aaf458-d621-4b3a-9fea-065b819e54af", "value": "f28a543cf626124d9b6482c5f711d5a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308350, "uuid": "1fd7447d-2dcf-4d1e-9278-c152711860bc", "value": "24576:nUVVU1DRst89qfhYCSZWD7QA62JwEzuMXo77hOs+AuubIgyt4I4YvxhE6g8/t79:UVS1Day9KmX8RSAuMgh+ghI4YHE+l79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651308350, "uuid": "e4f6f633-b584-433b-93eb-0ddfacd5a412", "value": 2067384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651308350, "uuid": "55cef8b2-a8a5-40d7-bb71-2a6956e25f08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308350, "uuid": "d0b495b9-2675-4989-930e-49c30d0c2005", "value": "b31bdf024f2cca1b6122fbf567f2ff03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f68d76a-c88c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651326603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651326603, "uuid": "e544daf9-8d19-42fc-abbd-1b1763a0dd9c", "comment": "Malware payload (Mirai)", "value": "b122f80baf62d25647f08ba1da1cb225", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651326603, "uuid": "b0159a42-502d-48d6-96ba-fe42c85527ef", "comment": "Malware payload (Mirai)", "value": "ede572d550885ca18c5614cb3a4f6db5910c6ca26db83bfe40ee02ad66de8a68", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651326603, "uuid": "06c0c4ce-9729-4aea-bf2c-dd274125ee7a", "comment": "Malware payload (Mirai)", "value": "680634c808cc4f9b2d660c415080b9828d0fa485", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651326603, "uuid": "ce7eb4d6-180d-4ae2-b2e6-7930c5d223ba", "comment": "Malware payload (Mirai)", "value": "75b7bf3d2412ee5a22bb401205dcee7403a4e88bb85017e8413bdd4dd7d034c3f6ac4156d824af67ffb14af3f9c86e81", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651326603, "uuid": "c12c6463-5e9f-43df-a11c-450f9c27baea", "value": "T151E26C82E642C4B6F85301B2317F9733AB32D5AA5419DF46C72D9536EDA2820972F7CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651326603, "uuid": "1f5b86cf-94c9-4e0a-bfb2-7bf4c599e0dd", "value": "768:oc587lbqqF23tRbk9BwuB7q4ilQ28pJMXrI9L2:oL5bqV9ABwI7xkSJCrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651326603, "uuid": "bb98d987-3754-41f7-9bc7-42fe198401c3", "value": 33940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651326603, "uuid": "2dd2b8ae-ecae-410c-9c38-6f5b3f9a2bb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651326603, "uuid": "fca72df7-8eb5-45a2-b2e8-b075cb53f0f7", "value": "beamer.x86-20220430-1350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6e89905-c864-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651309596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651309596, "uuid": "120761bb-1c50-47e5-aec4-206ba264373c", "comment": "Malware payload (Mirai)", "value": "1333f822abf37649eee73e80239f6a4e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651309596, "uuid": "c7b63e22-0958-4af0-9ad3-167efe6627c8", "comment": "Malware payload (Mirai)", "value": "ee257f11aeeef86b9767b4bb2da7945af66bc7509141ce3bab71079ba5de3e5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651309596, "uuid": "c7c5b8eb-ab84-4d0d-ba13-a3bfc1a1780e", "comment": "Malware payload (Mirai)", "value": "8fddc2a0cc10dcd377273f998ccadf7041ee4def", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651309596, "uuid": "13df10bf-3889-44a0-82b4-cfd19d8fc18c", "comment": "Malware payload (Mirai)", "value": "45556d60b8dd2f4a26f18210dac9c410e1150862c95b2e05c63ac1c3968fe4feb49e4e9fddbacf3746e18e6b8d66e5f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651309596, "uuid": "25690f86-6e19-4280-ad9e-c4ffdae47d2b", "value": "T172639DA3D8045ED0C5094238A0E48E3D5F53F94867671EB48E8DC4A6940BEFCB61E3BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651309596, "uuid": "29d00016-7e05-4143-bcac-3d572f747745", "value": "1536:L/c7mT5VaJoPosOfv3XJAe7Vlm0Xhakma1WQQqdC2r4s:LU0DeoPosKvpAsmuYaoQQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651309596, "uuid": "acc0093d-1a98-4b15-a7b8-5e5f35f4f878", "value": 72476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651309596, "uuid": "905789e2-fdcb-4c14-a85a-053546e6c311", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651309596, "uuid": "b727fd42-51d5-4f99-a93b-6249a8fd54b8", "value": "1333f822abf37649eee73e80239f6a4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec403201-c836-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651289875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289875, "uuid": "a1a916ab-27d6-47b1-a901-e0b0eaa22fca", "comment": "Malware payload (Mirai)", "value": "eca99f7038daa80d26e310cba82dd124", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289875, "uuid": "7221b686-926e-4091-94dc-861c31d25857", "comment": "Malware payload (Mirai)", "value": "eed378b2e98c9c4a4d931dc222bcebd260a8ebc81ea52bd577ffbc26e8b438f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289875, "uuid": "d1a7144f-66d2-4c91-b783-38fcb0cb042c", "comment": "Malware payload (Mirai)", "value": "5fe0836e7692ae16cde2e8804815b564dd9e4652", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651289875, "uuid": "afb872b2-3482-4296-ad8c-33ebbfa3445c", "comment": "Malware payload (Mirai)", "value": "3808dc4a505c3cd338a31cb3b0448985f6eaef3615b8be3e98cb0b1de14a5b98b0ee05b44f1612548e7ccde363b2ae5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289875, "uuid": "b3e8f763-dafe-465a-a71e-fda7b11655dc", "value": "T1CDC2E154E2902E95FFAB9C792CBF62C933135F9D6B24DFF233985823069254B0A15EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289875, "uuid": "4ecdf05e-dfa1-4614-a703-432e7eafa550", "value": "768:BUbgeS1f8Dnz+hu5EZKq7aDpOXIog/4uVcqgw09h:BUbfaqs7aDcXIoQ4u+qgw09h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651289875, "uuid": "65ebf69a-0c21-40a1-ac38-d6db3d6cc021", "value": 28280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651289875, "uuid": "5029f3fe-d894-437a-9a54-e4029b43b2e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651289875, "uuid": "c9213ee8-d341-4922-9f38-56fd513bec78", "value": "eca99f7038daa80d26e310cba82dd124", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77749d6c-c844-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651295692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651295692, "uuid": "e5eda332-d35f-4e30-beb3-aa4396146d95", "comment": "Malware payload (Formbook)", "value": "fd053d5c33cd94b52246c44bee1bf9b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651295692, "uuid": "9d8e25c2-00f0-402e-9cc5-5fc6bbd229fd", "comment": "Malware payload (Formbook)", "value": "f11b64aebcf22ad61d091223517bb34a45726674691ec02bf36ca36b6de83df9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651295692, "uuid": "cfcc2f19-0dc4-49da-89e0-2d9ae01a8dd7", "comment": "Malware payload (Formbook)", "value": "052fd9cb4ec40f0e512c8a84e674d307be71c5ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651295692, "uuid": "40d3d95a-634c-400e-9be7-ad46c2d0042b", "comment": "Malware payload (Formbook)", "value": "22c5feeead0217c2aced0d5c59b85aab5f57b2ec34a17fd5d6796961e5e53890ea42c4e5c136cea5015ffbe73d31f7a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651295692, "uuid": "9e351f25-1ace-4a80-945a-6e9f7fcadcc2", "value": "T17514020C6264C9A3E5A317721D7F57A26A9EE41120692B9F17B06F5C3D33AC26C2F353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651295692, "uuid": "492997a1-2673-4fa5-a626-b4115fc2dc60", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651295692, "uuid": "5122fe5e-2b62-4415-9447-c5a918b8855f", "value": "6144:HNeZmiSRaHizECTU4QpDV0Y2gonPeookrEvh9GdJx:HNlPqAf44QVx2XnPHgSdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651295692, "uuid": "a2aa5699-5723-4121-aee1-c66ed9ec2e8f", "value": 197112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651295692, "uuid": "efbcceea-3c00-4459-b1c9-df42639d840d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651295692, "uuid": "4fbbaa0d-d7cd-4b13-84b1-f67f3d70b882", "value": "PI160256.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87230c85-c862-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651308604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308604, "uuid": "4cf35a46-ff21-44c5-a482-baa26f7a8ac0", "comment": "Malware payload (Mirai)", "value": "02742a1be6f34744ba57320432c58c71", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308604, "uuid": "3d20d867-6f3b-4367-b4dc-cc91675eee2a", "comment": "Malware payload (Mirai)", "value": "f27d11656a5661eceee193d1c64328cbd7920d495eb0735af71c859cef9f88e6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308604, "uuid": "0e192fd6-6d8d-4f0a-827e-29351cc51bd4", "comment": "Malware payload (Mirai)", "value": "e67235c0591bcf9d2ab4386e4acc7171a0a9c35b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651308604, "uuid": "439ded84-c3d8-497d-8e24-2fcbbb7349c1", "comment": "Malware payload (Mirai)", "value": "ddb5051b1c8e9d7e15d85053d91a43d9db67a4d75639b6788d65fa417baa43e39c5b6e89618e2db4754affd33f7f9137", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308604, "uuid": "2fa1288c-0b89-406c-9bd9-bc5b5f9ae531", "value": "T16ED3294AFA408B13C5C61776FA9F41463322DB94D3EB3306991CABF43F8669D4E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308604, "uuid": "29253418-6f86-41a5-a3ce-24c1f9a95147", "value": "3072:CvLqzhWNCpReDsnRRIYKOXWWpQlbC7sfM/9VA3a:Cv21KDsnRRVlXMbC70M/9q3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651308604, "uuid": "b2271d08-c288-4e57-a6a5-ea584e8984a5", "value": 135586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651308604, "uuid": "c9b67e60-8c5e-4e9a-815e-7c5c81abf8a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651308604, "uuid": "c9a6f949-f888-435e-b3b5-013eb54fd17c", "value": "arm7-20220430-0850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80022c18-c881-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651321906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651321906, "uuid": "bba6f0bd-1541-466f-9a65-6fd28143c37c", "comment": "Malware payload (Heodo)", "value": "41a722f8622810ba7f1438c8da6941e2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651321906, "uuid": "816eea30-6c21-4fbe-b6b0-a59b2bd3e8c8", "comment": "Malware payload (Heodo)", "value": "f426aa555f077e0d9de1db5c9973f68fb2035e777ed2bdf0359134c0c6c17206", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651321906, "uuid": "49ba58be-eead-46d6-93e2-4ba0980778c1", "comment": "Malware payload (Heodo)", "value": "c1f63beac2791308b5a0a490e2feff2d4eebfa96", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651321906, "uuid": "9e7f3f1b-ef98-4c03-82f1-57433dbc86a8", "comment": "Malware payload (Heodo)", "value": "0d4c573f3667797eb8cf31479a4aaf815a3442480f61299977596de298169468401e736452c34abbeb6f91d9e68c8fcc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651321906, "uuid": "32e85872-6db2-4357-bf90-e55136a44455", "value": "T114158D326143827DE95F663AED22F7F7226FF91047709AD715442EEC89344EF0636A82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651321906, "uuid": "aafbfa25-2adf-4899-8513-c7173b86da41", "value": "1e8e7e5b053a6113954e3e4d9100279c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651321906, "uuid": "cffbd108-98d1-4a3f-8101-a3c7ffd5b790", "value": "12288:Jkalogyxm2HRLaJYiNLCRACQ+rGYPw+PYF7o8v+N:7ogys2iYaIGYIY8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651321906, "uuid": "c27c1a0d-2241-481e-be65-fbfbd06be1d2", "value": 901120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651321906, "uuid": "f7f7452b-d49c-441a-8ce9-61d7602c6aec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651321906, "uuid": "235beb6d-4788-4898-969c-08d6fa65b0cf", "value": "emotet_exe_e4_f905a08d70a7184769dbef84beee5accb3f49c428776590bcf4ab0d600e0ef3c_2022-04-30__123140.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6855f02-c846-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651296657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651296657, "uuid": "9d9d65d7-1f5c-4ed4-9c09-e68da4a9b1e4", "comment": "Malware payload (Loki)", "value": "59dcd2410bc8791753e2acb435d59841", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651296657, "uuid": "4bac1ffa-42ef-4c77-b1d2-54a8025b1b42", "comment": "Malware payload (Loki)", "value": "f6f49075eeed0bdefde53dd32236853b1aef0450eab9e4b99af6c11baee1e7b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651296657, "uuid": "7d4f7fb5-9bdf-47dc-8e31-be7108b084da", "comment": "Malware payload (Loki)", "value": "1a49a6a067074d32bff7a42df052cc5e8c774835", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651296657, "uuid": "a6efba7a-f3b0-4c33-a86e-f3ba6cfde10a", "comment": "Malware payload (Loki)", "value": "cdda1c7462e0ddebacc621759ab55503baadc6231828d5f7be3fd61f6ddfab388b43f76d56ef1a5dd4d19d56b40dc231", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651296657, "uuid": "50d0686c-01fe-4a42-9058-06556b2648a0", "value": "T152F3D05B29BAC1B3DE420677CD67ABB60D98DF511041C79B2B903B4B3B303D18A5BB49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651296657, "uuid": "33281d1b-4cf1-4101-9e93-3f436eb360ed", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651296657, "uuid": "9a671efb-5e6a-4797-aeb0-52a9039c7b69", "value": "3072:21NjcVVnLpPulgggggggggggggggggggggggggggggggggggggggggggggggggg7:ONeZvN6hnxj8XC4RbmQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651296657, "uuid": "bf0092ee-9fc2-4b5b-820b-c1d562200522", "value": 160127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651296657, "uuid": "5c92e622-1795-4ec3-8a93-6a78329eceab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651296657, "uuid": "c03dd399-633e-4c20-b65b-c3b9efcbfa9d", "value": "59dcd2410bc8791753e2acb435d59841.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a61022-c880-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651321598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651321598, "uuid": "78a9ba90-8c87-49b9-8c31-e25452a5afb0", "comment": "Malware payload (AgentTesla)", "value": "9e23762fa343f25878b22668a75b9cd1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651321598, "uuid": "89fdb9cd-2a6b-4d01-a548-012949ecf86c", "comment": "Malware payload (AgentTesla)", "value": "f85afdad8440a12921791ce0822f4c7fa4081b318ade1c38937dbcd313372f82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651321598, "uuid": "bfd064db-ea00-4c1e-b620-71e175266784", "comment": "Malware payload (AgentTesla)", "value": "9714798d60ecdabf1da870eb343ccb3f555f3b34", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651321598, "uuid": "ca9f5554-765b-4247-9dc9-d9ba6385ef4a", "comment": "Malware payload (AgentTesla)", "value": "8d0a7af3de813c107e9c89b92342de80066c69b48288f96f74083879445475c1b5c65d45eb7251e537cdaa311414c2c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651321598, "uuid": "2f40cac3-d32f-41e3-9826-d3ecc512c9a7", "value": "T1BAB42358A73A4D7DA280C1E3219819E6C47515DADF1DA41EBACC6C7F3A237C4F51888F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651321598, "uuid": "9cf38619-3f31-4e15-87e3-1c5fdd7aee49", "value": "12288:w7/e/Wk9gWyI6AFY0tMd9vGRgRjfvfmrrE7+:o/kWKgeNFGRmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651321598, "uuid": "e818e7b0-1097-4e13-881e-f57427dfdd3e", "value": 529320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651321598, "uuid": "e72ffaf8-ebce-4e67-905e-e3aee943a386", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651321598, "uuid": "38787295-6056-45b3-8cc4-c957438b6001", "value": "SHIPPING VESSEL ADVICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edba5daa-c825-11ec-8e58-42010a9c0032", "comment": "Malware payload (ZeuS)", "timestamp": 1651282576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651282576, "uuid": "6109e1c7-d9d9-4897-8dd0-277d8d5ddeae", "comment": "Malware payload (ZeuS)", "value": "06610713ff807c4aef983fb7a1fd6e77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651282576, "uuid": "a4da3343-5f5f-4869-a946-3bea97b18771", "comment": "Malware payload (ZeuS)", "value": "f964fe787eaafa4622c0ed9a8bdbf6a223d483ddce92109f75643f048a6a661b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651282576, "uuid": "7cd4bfe8-cf59-4d18-85be-7dddab857053", "comment": "Malware payload (ZeuS)", "value": "39cce69b9959e546dc9e3abf13e754d869da7ad6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651282576, "uuid": "eba485ef-0a3f-46d0-9969-88f6d1393efb", "comment": "Malware payload (ZeuS)", "value": "e506ac297a2d6324fce0c694b8c2d0077d4a40d42496ca0ba7c41f4a796fea5fdb0d157ac398ed031f7a3d30db1a28ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "prg", "colour": "#337559", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651282576, "uuid": "6c55ff6c-cbfc-466a-83b2-d9897b94144f", "value": "T169E422806A6DCAF3E42150741410EFD25BE3FD61142789FD2583CECA16A49E3B16FBDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651282576, "uuid": "a856f870-33dd-4f3b-b54c-866872ccfa8c", "value": "0c1e0b4890cc87424a0fd0132621e9be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651282576, "uuid": "8b6eaa80-550b-4937-a514-a5670a9b78b9", "value": "12288:cqrETmcRr/mWdWyr4I9t6JiRTKcAxycbls9d+/yjXsNAZLvVyxi:cqwTdFxr9t6JwAxycblCd+agKZLvVCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651282576, "uuid": "f30f0650-6db6-4101-bf86-6987eb0ec1e7", "value": 695808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651282576, "uuid": "0317c005-22fe-47cc-b71a-5b7a1d1075ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651282576, "uuid": "4cec768a-d6b8-4d2c-8d64-e77ef5ac0ad1", "value": "f964fe787eaafa4622c0ed9a8bdbf6a223d483ddce92109f75643f048a6a661b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213660d5-c857-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651303708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651303708, "uuid": "c02bff72-3e76-4bfc-a3b8-f16f2ea7747d", "comment": "Malware payload (Formbook)", "value": "58dceb5140d623515631300e2904e6f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651303708, "uuid": "a072902c-e956-4b80-9d19-e5e6b13a9048", "comment": "Malware payload (Formbook)", "value": "fab48c79a0d15a6718a2df9af91f389be253b83b280db8499004cf133aab1619", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651303708, "uuid": "34d4bcd8-ee58-4efd-b65c-e41476f4dab4", "comment": "Malware payload (Formbook)", "value": "6e48833b5b01c78ab852913dd9eb6aae0c6a1112", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651303708, "uuid": "747c17e0-e896-4ea1-bff3-006407acc94a", "comment": "Malware payload (Formbook)", "value": "106912eb3d55b6048bbdffb6ac0bffdeb79ba3b55102284fb8a35f6daf6da9c7d84b30e94eb7dfd86ce472427bbf2e34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651303708, "uuid": "3b42d08e-607f-48e5-8b4f-9504a127afa4", "value": "T1A7F41287BA1CCBF4D8399BB37DA3A04E4B923DF46A45C49BAAD3F08518747210E91573", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651303708, "uuid": "9d4d6f7e-18ac-4b81-b38c-cb6bdb189db2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651303708, "uuid": "83a46c1e-a5b0-4c6a-bde3-ce594a34c13d", "value": "12288:HLWJeqUS6OHUwFBNPkO4INxocf1g0YfM+rJgeinwAhP5mBjk0f:rQZHUOPN4INx123UEavP5Uk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651303708, "uuid": "9e0cd111-7c23-45be-bf82-45485fbdc5e8", "value": 763392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651303708, "uuid": "0cafeeda-e50e-4f2f-8607-ef807a123ce4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651303708, "uuid": "344d3522-87df-4919-b545-da591f8fbcdd", "value": "58dceb5140d623515631300e2904e6f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a8ad82b-c86d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651313280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651313280, "uuid": "6ad585b5-1de1-4cb7-b4e2-48dbc0eed4ac", "comment": "Malware payload (AgentTesla)", "value": "e769702af88eb81ecf5f0fa66b222ca9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651313280, "uuid": "0df4983c-c0e9-4b77-a915-2bbb5ca21a24", "comment": "Malware payload (AgentTesla)", "value": "fe643b32f551d1f217e7812643fa9a8ad8132013607ed69b60776de44f1712b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651313280, "uuid": "2368076c-1731-4d3c-a421-e8c548360c10", "comment": "Malware payload (AgentTesla)", "value": "010a061b8c84e146762245c0ac076551003d4a0c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651313280, "uuid": "617794d8-e0f5-458f-a3ce-ce6f17edcd32", "comment": "Malware payload (AgentTesla)", "value": "da1bc87bb0801efe1837cc78b308b5d81b83296cacffc9580ad11e8fd6f12d22c0c6524d2f5cd7ea7f52cf8bd0f69d5d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651313280, "uuid": "c724d98e-f2cd-47fb-911b-ef3a67ec33d2", "value": "T108C43305A1523AB21CAEA6E2B9F5A5E7C9F12F3D4B49492F5EFF1251520180FECE04CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651313280, "uuid": "2c45fbfa-2415-4a60-9ca8-9678356fc06a", "value": "12288:k3MkFUveg6AdrRTql8eFONFjxutUG8xf4EXg06YBkJy:kcrveg6AVlqlJOv+V8hBRYJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651313280, "uuid": "10be5c6d-9194-4a1c-bee0-8f6e77d93d9c", "value": 557394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651313280, "uuid": "bc096397-963d-4706-bb23-c5288f9019cf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651313280, "uuid": "2aaf79d9-f8fc-4b8b-9627-0e933366deb3", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "520c3128-c83d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651292623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292623, "uuid": "2bd99293-65a3-48b6-b5f8-22ac6b0e52ef", "comment": "Malware payload (Mirai)", "value": "7332706a56296f49d8df4774fa996856", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292623, "uuid": "0c001318-d432-4282-a3d3-6ddfe5f500f6", "comment": "Malware payload (Mirai)", "value": "ffe65acbdf6b6733ddaca87f0ad95df7066cee2c72feb090b7b6e565e24b8678", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292623, "uuid": "bcd2ef42-13e6-4a4d-91be-8a8d04f154fd", "comment": "Malware payload (Mirai)", "value": "ce28c9b1868591cd09b8da1978b6b3b9b86e7dc8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651292623, "uuid": "41c9ff74-a379-433f-a251-2f868d6e4a1a", "comment": "Malware payload (Mirai)", "value": "1e6492020b0c064dd68e858182dd4ca89af93bb21e858e418968c8062ba15bade7f6905ebb8e978a2be64d90a21bfb2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292623, "uuid": "8da0423f-e048-4a2b-8d5a-386c750c6f4c", "value": "T182832981FC41A622C7C11777FE5F018E371593D8E2EA32079C285FA03A9F95B0D67A5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292623, "uuid": "937320a4-e050-4b1f-9f9d-886386e5438d", "value": "1536:NySHwrZKkRozEsK3OU33eZtU5SWmzPeTriW/SnvL:NySQ9KoS83w9zPe31KL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651292623, "uuid": "24882082-56b8-4dd5-91ef-705991934752", "value": 87172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651292623, "uuid": "7bc4bfaa-0212-435e-bba1-e52f9eeabce4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651292623, "uuid": "385c0623-d2ca-43d9-87f1-1bab698be678", "value": "7332706a56296f49d8df4774fa996856", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }