{ "Event": { "published": true, "date": "2022-02-08", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-02-08", "timestamp": 1644364981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "3e88dd65-6a3a-48ca-8bb3-b8d2cf9b9730", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7f0820-88fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644338065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338065, "uuid": "d5ea0114-23d3-4eaf-b076-ab8521f6a756", "comment": "Malware payload (Heodo)", "value": "71499d67b748d742241df13e96c9bb04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338065, "uuid": "4bca45fe-f9d5-44b5-aa40-045979e37487", "comment": "Malware payload (Heodo)", "value": "00037f2d52219a6672d6a583e887a809250c96f8f0eacf7d8503848c874dac6b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338065, "uuid": "d146dad1-3e26-4e8b-8027-8ffc4f48da14", "comment": "Malware payload (Heodo)", "value": "1c585dce7ab6335e3874651bd2744e2ac1ba349d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338065, "uuid": "1f0349f8-8fdf-4efa-8c1d-a7c4a0130ca8", "comment": "Malware payload (Heodo)", "value": "cc585b0cd5981fe9d4f486672209a354e9a1234e40cb44b3948949aafecc859ab116f5377d3120533f592ee907d37c5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338065, "uuid": "7d821b99-d40e-4787-914a-aeefc7132766", "value": "T113848D06E652C03CFEFB04B8D496CA66ED5E3A24169D619F63413A6D32613CF123F52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338065, "uuid": "6c8e2af6-e334-418a-82b4-5ebf2c2897da", "value": "79fb40281049052b3e354a6e444da473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338065, "uuid": "dae1b38b-5c5d-4119-8e6f-1fbec0595a0e", "value": "6144:O56dLjBFLyztOokeYIjAmkB8lebi9JqGXdZ32mneM0laNUIbeURK46:YszuzNnjWB8f9JqQ2mnB0l4UMK46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644338065, "uuid": "8279af02-40f9-4d5f-9da2-0d9f79f4b0ef", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644338065, "uuid": "b4305a62-75b3-4681-a4f0-589844e89ff2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338065, "uuid": "484a9854-3150-4fdf-8c91-39e81e54fbfd", "value": "71499d67b748d742241df13e96c9bb04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db28063-8914-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644348191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348191, "uuid": "e0b66ac9-d1e7-4625-bb09-af6d7b5339d1", "comment": "Malware payload (Heodo)", "value": "011d2da46bd9475ce871e71af4d688a4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348191, "uuid": "d1a5cab9-1ae6-41ba-95c7-29fd8759a995", "comment": "Malware payload (Heodo)", "value": "0040fde9d3f2e40c1e1cd49e3e935b267ecedb15291f96c08646a70e9afb29a3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348191, "uuid": "b4caf48d-8be1-4632-8155-895fb16a7a5a", "comment": "Malware payload (Heodo)", "value": "62c6b9d305b15de9e4a5a3a51c860efadbd7ab62", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348191, "uuid": "83597545-e1c2-4277-91e6-b9b8c26f6fc5", "comment": "Malware payload (Heodo)", "value": "cf62d825f8758c31dc721feeac2c9e9399763c96bb497f00322f37203ac89d7194650b4ba283d98319bf52887fd7c1df", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644348191, "uuid": "872e6fc2-dcc6-4385-9072-aa43e94a84da", "value": "T1C2C35A55F685EA1ADE0812350DDFC7F9733ABC828E9A83473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644348191, "uuid": "84a82f29-f973-47a5-be24-2126573192ec", "value": "3072:jacKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBW:OcKoSsxzNDZLDZjlbR868O8KlVH37keC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644348191, "uuid": "b406b406-cd54-4f0a-a598-38c310fe1939", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644348191, "uuid": "923b05cf-f4eb-407d-b015-d6da835f99d5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644348191, "uuid": "084074c2-c3bb-49ed-b7ea-3d538702e879", "value": "tmp8frux4ir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96418a50-892d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644358942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358942, "uuid": "2000dd51-85c3-4472-9113-b3e652a52474", "comment": "Malware payload", "value": "3f592b207cc03b9d32a472bf049418a0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358942, "uuid": "388accb9-2da9-4379-a907-fad5624af08e", "comment": "Malware payload", "value": "00a0a385e7f5d8ceaab786818fe82d399b16d24111da010e75cf3cf8228f2fc0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358942, "uuid": "e0ab3638-0b00-4aba-912f-ebbd521d4d87", "comment": "Malware payload", "value": "832bdf72bbc170d269ed9b3a5a3a49db3bba93f6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358942, "uuid": "1373cb6a-d6fc-4aad-9289-7c78cb8a5ea9", "comment": "Malware payload", "value": "221497ca3917c43e67ab9de36becc2e6733bdd5dc095ff23e30bb9a068ee2a86dd05dfcba1b00a4afd7c259257d2a5bd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358942, "uuid": "ab2a04bf-1cbe-4d46-91e4-184970661337", "value": "T1FEC35A55F685EA1ADE0812350DDFC7F9733ABC828E9683473289B32F7D76590CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358942, "uuid": "8de44f43-f3ef-49a3-88cb-23914d7f6fbe", "value": "3072:D3cKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBI:DcKoSsxzNDZLDZjlbR868O8KlVH37keQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644358942, "uuid": "8e3e5535-517f-41eb-9a61-7b6ad21cc8ea", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644358942, "uuid": "4b39c6cf-7d35-41fe-ae78-bd85235a77d8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358942, "uuid": "3cb03d56-4728-4d24-9c12-9410cd31705b", "value": "tmp1m82n2i0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7437350f-88f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644333974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644333974, "uuid": "10571c64-12ab-4e0a-b275-fb9e23a02207", "comment": "Malware payload (Heodo)", "value": "1749007c3aab72887dd912d1f3749e0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644333974, "uuid": "ac687adb-18c1-452a-b16d-f79367d4dfa8", "comment": "Malware payload (Heodo)", "value": "00b0fd6d17e9382838502b1fa7354e78f02e9b9779fb62aad17d69af4fb48016", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644333974, "uuid": "1609f78a-5347-45d7-b9a5-7268b6fdfcd4", "comment": "Malware payload (Heodo)", "value": "ecf933fd93ba0d5a23a179c9eb51da8dd17ba0e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644333974, "uuid": "f494b94a-c1c3-4282-966f-e3cf90db0e1f", "comment": "Malware payload (Heodo)", "value": "85a4f6eaf511ef3cd00cb809fcdd4e6a807321185d83c8277e1016f19c7d4f81fb8b80b6345f740be27d07dc3d393f7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644333974, "uuid": "6c859d59-b79a-4d28-ae5c-5f788f696410", "value": "T1AB848D06E652C03CFEFB04B8D496CA66ED5E3A24169D619F63413A6D32613CF123F52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644333974, "uuid": "530504ce-7b93-403f-8afd-1f8e38cfcab2", "value": "79fb40281049052b3e354a6e444da473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644333974, "uuid": "cab5a3f5-8cf7-4d10-84f6-52423367fd2b", "value": "6144:O56dLjBFLyztOoXeYIjAmkB8lebi9JqGXdZ32mneM0laNUIbeURK46:YszuzNijWB8f9JqQ2mnB0l4UMK46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644333974, "uuid": "603cf7b9-82de-4bde-8fc1-0bafdc15fc9b", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644333974, "uuid": "4ee68d7d-e04c-49c5-9635-af1f2666652b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644333974, "uuid": "04c74da4-adb7-4e42-af70-5ce9f06cdbae", "value": "1749007c3aab72887dd912d1f3749e0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d0dc497-88b9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644308971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308971, "uuid": "7b7d6459-c5a6-479d-945d-bff3f8cf7c2a", "comment": "Malware payload (Heodo)", "value": "4ccb20aaa4c2f721a2bc3f7861d554de", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308971, "uuid": "a0389908-f284-445a-a194-2c2f6ef4a578", "comment": "Malware payload (Heodo)", "value": "00dee5fcd1254755a97b88df74b90c504bf58333255acf3f8d7cf1c9d5a05902", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308971, "uuid": "5b9402b7-a45f-485e-b60f-e1555e38f3ee", "comment": "Malware payload (Heodo)", "value": "10b5e79a1e5c823714f79f1dcf88c77e420ff581", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308971, "uuid": "6c47befe-82ab-4516-8dd3-533a1805d038", "comment": "Malware payload (Heodo)", "value": "f0e7c3abc31bb02e1c3221625c08127845c61db5428aea0952ec9f3a1ffeee72b7fde30070d78b9e6e542b19b57d0d1a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308971, "uuid": "56a8c34f-ce4e-4e7a-892c-8e011d67388c", "value": "T15B93499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308971, "uuid": "ed758c73-5304-40ff-b4d6-6a8bfa53eba4", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644308971, "uuid": "ed19fb1f-45aa-444d-a36e-36d52aa72deb", "value": 97306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644308971, "uuid": "266ec3b8-641e-4a48-aba7-c13003950350", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308971, "uuid": "f3b2bce5-d936-4fb6-b64e-f7923a1d95e0", "value": "tmppxh0bw55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873a2c46-891a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644350757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350757, "uuid": "dbd70651-1472-4a7d-85f6-eee44497dfe4", "comment": "Malware payload (Heodo)", "value": "528d831c696112373070bfec2658c609", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350757, "uuid": "ed6eb591-a7fb-4949-b4a7-d32ce069627d", "comment": "Malware payload (Heodo)", "value": "00f092be65e16cd7037106494f09f82966502175140681baebc652f4baeed614", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350757, "uuid": "cf5a6795-8afc-4cf0-b87d-66d5800481aa", "comment": "Malware payload (Heodo)", "value": "33a3052a97e4b433778e7e85829a7bfe1e207130", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350757, "uuid": "18e3dd56-e1c2-41a4-8b34-3a855c713c38", "comment": "Malware payload (Heodo)", "value": "826c8c6e1c87915b3b628543cee5d077b7033f06dfee75e67b9620c120c9d79a86f0cdaea464170e95fcf593d9a1f446", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644350757, "uuid": "7f516543-309d-4e5c-aa4d-7a2b3d5eac2b", "value": "T18CC35A55F685EA1ADE0822350DDFCBF97336BC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644350757, "uuid": "8498396f-d98d-4140-8fe4-12f902ef7372", "value": "3072:NPcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBH:5cKoSsxzNDZLDZjlbR868O8KlVH37keP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644350757, "uuid": "12561d49-afa4-4b12-a5fc-016a17b5e7b3", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644350757, "uuid": "83f61d06-4858-4e1e-96eb-28b6fb64c503", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644350757, "uuid": "cd516d02-1d2e-422e-85f8-8b19e5b6bb9a", "value": "tmpywr0higi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0537e8-88e2-11ec-9275-42010a9c0029", "comment": "Malware payload (BitRAT)", "timestamp": 1644326792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644326792, "uuid": "c4931c0d-20b4-4d35-ab10-5a33f26d3ca8", "comment": "Malware payload (BitRAT)", "value": "2f7c805d358aae9d60d730e8ed5c4a03", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644326792, "uuid": "18d6458c-b2e0-49d6-bebc-6d387f51cd42", "comment": "Malware payload (BitRAT)", "value": "00fca5381ec94c0e1901a3fa10fb5d38e73c06af17df98af463e3a4393246685", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644326792, "uuid": "2a2ea230-fd6a-4477-8ed0-30c796db1e61", "comment": "Malware payload (BitRAT)", "value": "dd5a8fa46fc52cf4b26046d3a0f9f2ea4a0f03e5", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644326792, "uuid": "48704e5c-90ae-4271-898d-3503a873b4ea", "comment": "Malware payload (BitRAT)", "value": "da1b3089cf388c816aa1620932fe257595641be688bb7044c6d08551bf694f310949648da0141e21a3b53b4a25449fb1", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644326792, "uuid": "cedf039c-9a45-4d24-ab7d-c83550ead697", "value": "T1BF9533F013FC0B2DC2EE4E70687921405D7BA6D357A2CF5B6D4169AF9C523C62A22397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644326792, "uuid": "4e0672e0-6d11-47eb-8200-4956d590c897", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644326792, "uuid": "f1c1264f-3528-44d3-8d3b-ff2462d1d733", "value": "24576:1nn16VRtv0p2rNRf07HtFVoQ9jTLxM7t+OExsbgAWAVFiVs1Z6UhbLpRPzy+v1/f:iVgp2rNRfINFv2MpAziVs1Ik/emV06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644326792, "uuid": "8d02d886-b0ff-4fa6-b23a-14b3643da183", "value": 1967616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644326792, "uuid": "2b4484f6-bc56-4f90-b50b-8fb5a35111c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644326792, "uuid": "e64c4b80-7cf5-4228-9086-7203c6b55605", "value": "Bank Copy#547896532123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a8ebcb-88a7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644301521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301521, "uuid": "b08e6d6a-7b31-46de-bcf4-9855b6737fa8", "comment": "Malware payload (Heodo)", "value": "c68a12cdb522a58339a01560aefe56bd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301521, "uuid": "754e9726-8cd8-4c3d-92bf-20699452f9f3", "comment": "Malware payload (Heodo)", "value": "01776156cadd743ddf585aae7903efadc01964e9ce08ec1d14897db586f5a798", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301521, "uuid": "a96ace7a-8f52-483e-bcdc-a0bd5859034f", "comment": "Malware payload (Heodo)", "value": "c438e6157b99280ac3843181f3fb8d95bd7fca04", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301521, "uuid": "39894be9-6a76-4700-8580-b1d84690d93d", "comment": "Malware payload (Heodo)", "value": "2168e596bc9bdc7ec671342dcb0a296c7d7222c0dad5c693f966b1eb22e3cd0e159a6c435d152f47acf7136a100916c5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644301521, "uuid": "825ac58a-c26e-4443-b9e7-c46cc9334b88", "value": "T1CA93E16D2E1C2D07E09EF134DF3CDAA083285DD166A2F4BA64A03FB9543D493C65AE5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644301521, "uuid": "7d237645-54ed-4eff-90bb-af46ce41ad46", "value": "1536:zZRkPTTyDJm3LMrb8SKa3Xm1WBXz7yL64i+kkfa+3gtfvjHtoxzg5bjIFu+0:zvk76iLZa3Xm4nC5X5gxvhoxzMIz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644301521, "uuid": "deaec45a-517a-4d2d-ab99-b99b9e215294", "value": 94225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644301521, "uuid": "53757979-febe-42dc-9d68-47ab98176872", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644301521, "uuid": "ec11ce50-2671-42ae-bd2d-d769543ac4bf", "value": "tmpp_93ymmx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d04c0f01-88ae-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644304494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644304494, "uuid": "4ac64246-4506-42f7-8389-fd1f61eab5e9", "comment": "Malware payload (Heodo)", "value": "f139c6cb07bc4804ae52892d76d1225e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644304494, "uuid": "138198d4-bb0f-45d7-ab3a-cd79fe6d75ff", "comment": "Malware payload (Heodo)", "value": "018eab1eef8c06c556addcc986a71b4c5beb6478945706cbb6c929feeda71d65", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644304494, "uuid": "2c9f10a0-2ed2-4110-8080-fd527087b8d3", "comment": "Malware payload (Heodo)", "value": "85aa723176d30fba588448e77f79cc8e87a157b9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644304494, "uuid": "abbaeb75-8e1c-4c33-9e3b-119908e023eb", "comment": "Malware payload (Heodo)", "value": "215cf0bec832a1d0e7beba94705b277eb07920a0759b758e142981dd3b97929778bab416f1aa8a8cb56c8a5f8dcd155e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644304494, "uuid": "5d89faab-fed2-41db-a2f0-35de53a2a2d6", "value": "T18593499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644304494, "uuid": "5c845987-662c-4e88-91b9-c825766835dd", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644304494, "uuid": "b5621bd4-348a-4f0b-909f-0e8b59fa0a58", "value": 96569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644304494, "uuid": "642ff825-a03e-4146-b90c-13f160a35fb2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644304494, "uuid": "39411882-f7ae-464b-b2f5-4ae80008bc7e", "value": "tmp57sa_phr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b4f6f2-889d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644296881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296881, "uuid": "e002d530-8268-4780-8707-c8bd2839e62f", "comment": "Malware payload (Heodo)", "value": "ac252eada05536fcdf33860dc4878e60", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296881, "uuid": "b4517419-a674-4476-b3b2-752b4978f8fb", "comment": "Malware payload (Heodo)", "value": "01e858b2104e97832218a3caf74c7f6a299cc596265f3a019ae9c00499a234d3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296881, "uuid": "a37d9f1c-3bb6-4b9c-8c6e-8feea1eabc64", "comment": "Malware payload (Heodo)", "value": "950358aea909f0a20f7c7d2c437435956a065b00", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296881, "uuid": "56428951-b728-4e68-8f2f-4b24343c4cec", "comment": "Malware payload (Heodo)", "value": "cbc44b814961710ebe3597066adb1e3ad47b3cb0e996f43d83e5e33d16e37f30959d4862d04afd3bcd7157ec01855616", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644296881, "uuid": "714fab00-2141-4008-8d63-0778bafed497", "value": "T10ED38D6ABA48CA0BD94953314EE7CBF67335BC819F5297473295B72F1C3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644296881, "uuid": "477e3056-1442-4090-8ac6-ee7346b5ac57", "value": "3072:ocKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa37:ocKoSsxzNDZLDZjlbR868O8KlVH3skey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644296881, "uuid": "6b2a05d8-9d90-4cc5-8212-1620c70c2886", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644296881, "uuid": "08204d2e-00c5-442e-8038-67196e7bc473", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644296881, "uuid": "8fabefa2-d742-4d18-b587-1bd136154136", "value": "tmp4rqe0tod", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404b0037-88ce-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644317996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317996, "uuid": "1c7bf098-4efe-43e1-bdfa-a5e3835163a9", "comment": "Malware payload (Heodo)", "value": "8d39cef5a6741d6a85443ee348ec4d12", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317996, "uuid": "f48ee6ce-41f7-4f95-88a8-15e7121b3832", "comment": "Malware payload (Heodo)", "value": "01fd7f46f4a98abc8dff9dc8021ebb2f3c2c5a854e2d0a695c27d197542a396a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317996, "uuid": "87d017d9-96db-4d69-8212-e995d301c161", "comment": "Malware payload (Heodo)", "value": "0d2bf7503691c2c98713dedbc899052df1e0fdac", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317996, "uuid": "6866bc4d-0fb3-4769-b9f8-a2de1485fb27", "comment": "Malware payload (Heodo)", "value": "89970ccf3f811a9295158f6ca02ddb98df7a23427a803989f54e1ac5fd3353530eb6d81f4cc403ff208f050321124afd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317996, "uuid": "80e8a6c4-1b8f-4770-a4a0-787c58509674", "value": "T18693499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317996, "uuid": "3d7cec0a-371a-4b7e-9c76-20bef22905f1", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644317996, "uuid": "5ff61c7d-6bd1-4c98-8bf0-a5aa8bd63b03", "value": 96884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644317996, "uuid": "83674c73-3902-4bf2-8619-e9f02c452b71", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317996, "uuid": "87ec74cb-7efb-4e97-9613-43fa624ef512", "value": "tmp4haf2oqf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e886160-88ac-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644303336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303336, "uuid": "9dbe5158-8c65-401c-85b7-7e7c51db5d2e", "comment": "Malware payload (Loki)", "value": "dc25d6702933f6b05d5a6eb35ebc9cae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303336, "uuid": "31f185ec-d8ce-41e8-86c5-146bb9899288", "comment": "Malware payload (Loki)", "value": "02123a89ddac869b20148825d4d486598c910a71b300937f4b461cdab90f960b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303336, "uuid": "8116b332-79fc-4e72-afb2-40e7c499ddbc", "comment": "Malware payload (Loki)", "value": "8724aa402d3de8c163241d6b40ebb2ae0eeeeca2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303336, "uuid": "9fa965bc-fd54-411d-ae52-cdc2c0f4bc7f", "comment": "Malware payload (Loki)", "value": "4fd4fb954109bdf34d351f7ea8377563c141ed4b3d7ec50259d90561a31b1d34865a2ebb27a161954f4c99c23a1bd5db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303336, "uuid": "056be32f-78ac-448e-8502-1c50299c79f0", "value": "T1A7C459B4E56159A0DD6BDB306B32CD394F237EBDA935642C24CD3E2B3BFA6960111423", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303336, "uuid": "3de94b33-d310-4b3b-9d46-598460e87bed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303336, "uuid": "25944850-6551-450d-b933-26f87d885d81", "value": "12288:LmWjApfq3S4h97JWSXAy++vWZ11P7r9r/+pppppppppppppppppppppppppppppb:VjA1q3S0gSXpDC11q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644303336, "uuid": "c3fa6605-11c6-4598-bc2a-4ab956cf4f6b", "value": 593408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644303336, "uuid": "18b74bd8-6ae6-4182-baf0-09630efe8f21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303336, "uuid": "ab61296a-3829-40fb-8970-cdc757200ea2", "value": "T\u00fcrkiye ?hracat\u00e7?lar Meclisi yeni belgesi ba?.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1edd3386-8905-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1644341562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341562, "uuid": "d0ce88f0-d4ed-4386-96af-8fb22f070945", "comment": "Malware payload (RemcosRAT)", "value": "8a1dbbc5b3abeafbfbd1c8c56fe1890f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341562, "uuid": "ccdda664-0817-4d22-85cf-3fab4d1fa3e0", "comment": "Malware payload (RemcosRAT)", "value": "025c85a279531df5a29ffe04cf20b36c53280fe265083b07dfa2cee63d20ceec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341562, "uuid": "1f4d8782-2524-4ee2-95c7-281a37f83413", "comment": "Malware payload (RemcosRAT)", "value": "5e1c3a642649a55f34e8512f06e64ea86fda817e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341562, "uuid": "e01de8b9-ae8b-474b-a72a-331be0c3b86f", "comment": "Malware payload (RemcosRAT)", "value": "7076a9cd855f2c2a5cbe02a37fa3a266220b0aade66d1a6ec51c8dc3e9c45df3e4b4aca6e1edf0019d91c06cf26dccba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341562, "uuid": "de81643d-58a9-4091-bc80-e9721a8ec155", "value": "T16C641260FB62892FD9A3263938776FB75F64EC24D1B25B073314BA0E7D33591A99C240", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341562, "uuid": "4bd5e4aa-514a-443b-8280-296055a0b53e", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341562, "uuid": "f492b1cf-34eb-4803-884d-5f9eec28e031", "value": "6144:UbE/HUgnKS4MrxULN4FBMrbCtLiVaEUTCG5w92oUjGmmpJpG1d9xvksNBk8UAu6:Ub0nKHoxULoMfCkUTCow97UjGmg0d9xF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644341562, "uuid": "940cd779-3938-4ddd-af62-4a4ed3ed3052", "value": 329552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644341562, "uuid": "7465f116-8aa8-411e-b436-0b55e008e35c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341562, "uuid": "800b32f1-c078-4bd4-a3f8-a0b9cc412465", "value": "EmplContractAgreement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592247bf-88d5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644321044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321044, "uuid": "38a401e1-7fc2-47de-8f9d-1ce6580f8516", "comment": "Malware payload (Heodo)", "value": "1a629e3660d6d10609ea045de4fe9dd7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321044, "uuid": "04ca51b8-1bb0-475d-8986-0e32f36d913a", "comment": "Malware payload (Heodo)", "value": "028a5447d36c7445e3b24757d5cb37bafa54c5dfa7c3393fa69dd26e278442a4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321044, "uuid": "a297a2f3-19ea-4bc6-a23f-c92bff45af3a", "comment": "Malware payload (Heodo)", "value": "cef1dda75ec1f53d962ccc41cc864aa6dcec8977", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321044, "uuid": "47ec428d-58ef-4d15-855a-d4e2aa835a42", "comment": "Malware payload (Heodo)", "value": "318c1ca908ae5acb6b438a82ed1b125b78f4f36eb0eba481549e14312e6bdc1208c77e08b56b4a77d899d367be2b2aff", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644321044, "uuid": "b9109c08-f7a0-43a7-aab3-53fdedf9b871", "value": "T1EAC36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644321044, "uuid": "f41f827b-9e45-46df-9df3-cb4c47e11673", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644321044, "uuid": "bd009f57-6696-49b3-9c01-beb739611393", "value": 127997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644321044, "uuid": "fc80eb58-361a-4e5b-af89-61c9f82d573a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644321044, "uuid": "8c66f560-3955-4783-9125-3ed44fe0cc21", "value": "tmp6gcb6l2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a328159c-890f-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644346079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346079, "uuid": "91b63082-012d-465b-bb89-1283d908a04a", "comment": "Malware payload (AgentTesla)", "value": "c135b1ec294ea64ebe3469ae9c8d7ae7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346079, "uuid": "8da9bc64-38de-4439-84c2-9bb5ecd45ca3", "comment": "Malware payload (AgentTesla)", "value": "02b32b969ac78b0bb3caf5ecd061f54b5aef5590584e74a6a5537551f6aca83a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346079, "uuid": "2dc5be9c-4569-4d46-b62f-d027b2952799", "comment": "Malware payload (AgentTesla)", "value": "a70c2a6f665ddb39655476c02339df7af865dd21", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346079, "uuid": "1b2cff1f-2b9f-4f58-a28e-ee17e485c0d0", "comment": "Malware payload (AgentTesla)", "value": "803d27c1f64016f1b9da9f81931dc97863d4a8f11ba02031a4e618b94d3dd31236b5858da1191ed1bfa775fc76d34d76", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644346079, "uuid": "9579922e-7c1d-4563-9f83-559e9e02d1f8", "value": "T1ACC48C2F49BE213AC6BCCB7199C0CE1FF466C5963977692D26C225D905232F275C222F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644346079, "uuid": "2b53afc3-c4a8-4f45-a779-c79561061999", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644346079, "uuid": "5391f753-0114-4406-be11-0ad6eea6b2dc", "value": "12288:efeGnO6hlBO+fnwvwQ00iB91HdN2w0I0:e1O65jnwvRjC1j0I0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644346079, "uuid": "b41d8a60-697f-4334-8c9c-e7510dc2a0e6", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644346079, "uuid": "fd0eaaa0-5131-4ac6-93b2-cf7b68d88845", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644346079, "uuid": "0408593b-a33b-421e-8ebf-24fe106e5317", "value": "c135b1ec294ea64ebe3469ae9c8d7ae7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95601a9-8881-11ec-9275-42010a9c0029", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1644285101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285101, "uuid": "7769b95c-8b3a-4f6e-adc8-37c21e424b30", "comment": "Malware payload (RemoteManipulator)", "value": "5598febfbf00839c9f7047d9fe3205e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285101, "uuid": "5d681bf3-be7a-41ae-b857-04fc39c0d49c", "comment": "Malware payload (RemoteManipulator)", "value": "02dda0916789c0c3572cbbf0e119cbae7be42e10eca39be66bbaaf2468a62b7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285101, "uuid": "e949c03e-bc1a-4493-86ac-5fca1edba614", "comment": "Malware payload (RemoteManipulator)", "value": "3bc26a4c8e5f8a93671c9e24678530b51224ef61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285101, "uuid": "e4b1c044-718e-412c-9548-bd328ccd013d", "comment": "Malware payload (RemoteManipulator)", "value": "38254cfb3060c1b25eec453809fc0c89aa944cee3b36dccbb8dff27c4bb4abf909dad0fcf86a41d5a49c212c194e8fe5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285101, "uuid": "196664fc-595f-4e20-a357-ff9ba124e8d2", "value": "T1E3073352FBE50818E4BB5B7B8DFD4B140B6BBC99891243C81358B0299C773826DE57CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285101, "uuid": "e073d7be-c3af-45c0-9c5d-55ecfc93d0b9", "value": "38be718d163809a15e0c7a672311fe41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285101, "uuid": "666faf72-cfac-48f4-86b8-681a014ad998", "value": "393216:fBPaYwNAo0ZbxKOkJ6G219AU/DafoxrB:fBSWvxaJ6jbLG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644285101, "uuid": "ab000c4a-8c22-4aab-b89f-2110a6f73d0a", "value": 16961008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644285101, "uuid": "ccdddf01-d107-4b04-816e-84f85c5259c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285101, "uuid": "b957289e-d8d0-4756-8785-b95520836ca9", "value": "5598febfbf00839c9f7047d9fe3205e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd9672e8-88ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644339359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339359, "uuid": "dfbc2130-da8b-4995-aac7-f25b53d938b4", "comment": "Malware payload (Heodo)", "value": "ad63e707248e363f90f990192cf6cdfb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339359, "uuid": "6df46acb-1446-4bb0-9cc6-b8ae3d22e07b", "comment": "Malware payload (Heodo)", "value": "02ea63ac6cc3cf676fe9faf1c2fa2e4e4522ddf7c939a1ff1d8de085e775ba51", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339359, "uuid": "8b5c8fa2-8b27-40f6-ae02-6a81200f6546", "comment": "Malware payload (Heodo)", "value": "5c8b2409676a896cdd2de8de42eada979f0f678c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339359, "uuid": "e125417b-47da-48bc-9946-0afd6a888b6b", "comment": "Malware payload (Heodo)", "value": "5f93977b99dbad3ebbf131fc2d954256caf00f76c8cddbf613bbffdf26b4240ef99f56eb7f31fc92ab91098b261af598", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339359, "uuid": "05b8ccb5-86b7-42b4-8694-fcabf871023f", "value": "T100C35A55F685EA1ADE0822350DDFC7F9333ABC828E9683473299B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339359, "uuid": "f4a2cf09-fe95-4265-a16b-a940fcffac9a", "value": "3072:hBcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLB1:fcKoSsxzNDZLDZjlbR868O8KlVH37keJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644339359, "uuid": "a11090e3-aa5a-4bdd-9de5-1f47256702a2", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644339359, "uuid": "3535098d-8f11-4a2f-9129-fce367fe3442", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339359, "uuid": "c8c73bd3-4a55-4698-b65d-e8e317694440", "value": "tmpjwl0qvxb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b6cd2c-88f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644332601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644332601, "uuid": "3696545c-2158-44a6-8b27-d80f32083223", "comment": "Malware payload (Heodo)", "value": "baf2651076bb61ecbe5f18bd99786bd7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644332601, "uuid": "da4ee123-4039-4038-8ff3-5431305a0f47", "comment": "Malware payload (Heodo)", "value": "02f7f6dfcb7223d3f58becb4ec278db2e6ff0c68681b82fbc0b81c94020b8611", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644332601, "uuid": "2dae2078-21e3-4c1e-b40c-d0b17138f7d6", "comment": "Malware payload (Heodo)", "value": "ffb82411fca8d67cc5439cae984bc905007f7ddc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644332601, "uuid": "482bbb1a-5ee7-4487-bfd5-1e6b29b5ee1a", "comment": "Malware payload (Heodo)", "value": "9ded86eaadea620f8bf0b47c3ba68d7a06e920e8f4ddf40d3830940b75c7ea00e6f6be89411212cc50cc9480e9997465", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644332601, "uuid": "b37ad02e-84ba-4a27-a441-008e9bf2b2a9", "value": "T1B7C35A55F685EA1ADE0822350DDFC7F97336BC828E9A83473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644332601, "uuid": "0e7ca7c9-ecfe-46ae-a710-f94ef01fe9ea", "value": "3072:tTcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBI:5cKoSsxzNDZLDZjlbR868O8KlVH37keQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644332601, "uuid": "12ade35d-3178-4c24-b917-535b5eecac16", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644332601, "uuid": "7a75046a-c6f3-4ca3-964f-e9f4b79a4cd4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644332601, "uuid": "ddf413f0-5df0-4fb0-884f-7c93ecbc3aa7", "value": "tmpac0z8qzz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170e8b60-8912-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644347133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347133, "uuid": "7343c569-c448-435c-99fd-959f357863b7", "comment": "Malware payload (Heodo)", "value": "0423bf6549c60f397a681cd9a0a51db0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347133, "uuid": "79914a6a-02d4-443e-bc8c-c6f91e083e68", "comment": "Malware payload (Heodo)", "value": "02fbc1be47fd9099631bc9a4a0159e6c6c72200a6b209a6aef431102eeae6091", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347133, "uuid": "dfbe4bb0-2646-4868-871d-9f4695881d7f", "comment": "Malware payload (Heodo)", "value": "938fa78ce82871748ebc6f9441566684708b113c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347133, "uuid": "14fbb0fa-f881-4b8a-bc7b-b4baa7b17fdb", "comment": "Malware payload (Heodo)", "value": "dfee9cadb494425a942f0c97cab4baf3c7945c782e81a0b59f7884be044e9e1c7cfb4782397b6404ddd57120f927c71a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347133, "uuid": "06ae63ac-999c-4cfe-b151-7515f221eb50", "value": "T181C35A55F685EA1ADE0823350DDFC7F9333ABC828E9683473299B32F7D76550CA12606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347133, "uuid": "3063e92e-7775-43ba-ba53-fc0dee6ad116", "value": "3072:FGcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBW:IcKoSsxzNDZLDZjlbR868O8KlVH37ke6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644347133, "uuid": "d99facf9-9a60-4745-8c30-888739a0dbda", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644347133, "uuid": "e5859663-8655-4ef0-b38a-4bcfd4138e9e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347133, "uuid": "8fe19336-2f1e-4397-a3dd-01f08a67ae35", "value": "tmpbq79z6xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6661ddb8-88c4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644313765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644313765, "uuid": "682688d9-3432-4e29-b83d-fce5055e4395", "comment": "Malware payload (Heodo)", "value": "109010347408e62f72de3d10e070e707", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644313765, "uuid": "1eba99cb-2f4a-4c59-9d8d-b2f917d00145", "comment": "Malware payload (Heodo)", "value": "0308d35e49627803cc50683396108545eb409fc61215ca34d14e4c4988c6a518", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644313765, "uuid": "d4ea88b3-3482-4fdc-a7a2-cf736594444c", "comment": "Malware payload (Heodo)", "value": "2c6d7e161cef3a42703937dc826156cdce6edf81", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644313765, "uuid": "cf0690ab-482b-49fb-9637-c34632a4f426", "comment": "Malware payload (Heodo)", "value": "362873008b709bf5efb053a31fc5493bfbc7d189e150d819a1cc646d8cc2aacd497b63778092943d8699948a5deb283e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644313765, "uuid": "d4dc1ac4-f0a4-43e6-a926-af53c94df158", "value": "T190C36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644313765, "uuid": "73e2a9fc-d4ce-4221-a830-e072bb389825", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644313765, "uuid": "81ff12bc-5cb6-4829-bf39-39940f407bab", "value": 128570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644313765, "uuid": "5bc1b812-8ece-4d5f-8022-74c97f40611e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644313765, "uuid": "6ecce7ce-2477-43c8-977a-d267a900c44e", "value": "tmp8s4bd4dp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf9fa3c-887c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644282689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282689, "uuid": "95aea2e6-da2e-4a16-b876-5ce6c6dcc73d", "comment": "Malware payload (Mirai)", "value": "817ef3be9acf8a844a1200a84c636ca2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282689, "uuid": "5a1a3999-ade3-43e6-a7c1-7cfbb6faaa32", "comment": "Malware payload (Mirai)", "value": "03197968315711a29107dfa808d8c256eeaab74ef6cf4b91f89bc2c0e2405b72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282689, "uuid": "f36fd31f-4173-491a-ab6d-41cf83272be2", "comment": "Malware payload (Mirai)", "value": "2d1af08a9664a5d75dc3166c16119e09be9aaa29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282689, "uuid": "8c64bad4-6b17-4fa7-9678-d5fb24697601", "comment": "Malware payload (Mirai)", "value": "bc31a615fdb9d94180b48473fd23eef7011cccc1d2ef0e28209d5dc7a0fd7d20bd7540d89b8853ec6729eeeeeb73087f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282689, "uuid": "9569899f-654b-4159-b3b0-520d9e37ecce", "value": "T14583E806BF650FB7D8AFCD3319A91B022C8C665B22B93B367970C558B64B24F15E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282689, "uuid": "b73e94ea-9edf-4da9-b95e-758cdc46c211", "value": "1536:vI7eHITF4bt2XEsIkzZ9s9NEiNNpsEZHfJ7C6Ea10eG:vjHITF4btGrIkzur6E6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644282689, "uuid": "f2a2d7b0-e743-4071-84cb-341174353dfe", "value": 81540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644282689, "uuid": "6a96bc21-2623-4d31-83b1-0f20dab43802", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282689, "uuid": "7cc0de46-8c2b-48ca-ad9c-1338cb4449e1", "value": "817ef3be9acf8a844a1200a84c636ca2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee5059f1-88a6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644301108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301108, "uuid": "e537bda3-03ba-4bed-b48a-aa19ad47f5a5", "comment": "Malware payload (Heodo)", "value": "f1c2781f67b152adb9dbd8a9f436cda3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301108, "uuid": "e1ebadf3-81b5-48f6-b1ed-f29fc105db23", "comment": "Malware payload (Heodo)", "value": "033978652cbf156ef7c6ae2b4db9571f97311a76021c0c64a83191e88bca1283", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301108, "uuid": "79fd7fa7-42fe-484f-8965-6768e4b73e2f", "comment": "Malware payload (Heodo)", "value": "e12f3c73c424380a51a5321340daa80dc2e3a895", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301108, "uuid": "6d8fdbba-e4af-4d22-8aa4-715965a551e3", "comment": "Malware payload (Heodo)", "value": "7ab7fd3731ca50d39a43d4917a1ce372dfa905bab957468c2d89b2f728cfb4cde6c8b5a698d101de48e890313a64ee39", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644301108, "uuid": "a83a191d-17cb-4e3d-8615-ec4a25654d6e", "value": "T15BD39D6ABA48CA0BDA4953314EE7CBF67335BC819F5297473295B72F1C3A580CA07B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644301108, "uuid": "6c8745b1-449a-48a1-ac67-440b92a71150", "value": "3072:BcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3q:BcKoSsxzNDZLDZjlbR868O8KlVH3skej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644301108, "uuid": "69116e52-596f-4d8d-988d-711225a6b575", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644301108, "uuid": "0211313b-0456-46e1-9b3c-801c9638c6a5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644301108, "uuid": "a0aca661-04ca-4193-8ae3-4a0bfa4cdb6d", "value": "tmpcbidtqar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "310c88e9-8905-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644341593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341593, "uuid": "5909a82b-cfc2-4a0c-a7ea-bf2dd6fbb951", "comment": "Malware payload (AgentTesla)", "value": "550ddb733b658b80c4e3d423100d93fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341593, "uuid": "4de66db2-e654-4cd4-b463-4411596961d2", "comment": "Malware payload (AgentTesla)", "value": "035951dbe580e588b7d518a26978c8034f6ab24a5560389d0ee88f7a3fbadcbf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341593, "uuid": "76d30999-9836-4279-9f97-b93d5efeab30", "comment": "Malware payload (AgentTesla)", "value": "30c862e3f5b65bbf446cf3e81ae52bb62c14701c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341593, "uuid": "9a91eecc-fe64-40e3-a6db-15126017f595", "comment": "Malware payload (AgentTesla)", "value": "131661c4f635f2af625334d1a4fa19cecfaed08f19ae0ad1195a8e0a1b028ee19fb1d7cdd529f15fb0e16f2e920d944f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341593, "uuid": "4659d597-d89d-46d1-9272-bd6838bc26da", "value": "T1B9C48B2F49BE113AC6BCCB7199D4CE1FF422D5463977692D2A9226D905232F374C222F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341593, "uuid": "6ecaf7d4-6273-48bc-8e56-7191958b4a4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341593, "uuid": "2f578f60-4e65-466b-aa4a-5e569c47354b", "value": "12288:sMrZbg3W87+D4GQg5Px+wLqKF+YKjaT7vte:sM6V24GQW+wPMgw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644341593, "uuid": "93560d04-b087-4c3c-86bf-6788fabf651f", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644341593, "uuid": "c54c0c38-37b9-406f-a92c-7fc432762fb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341593, "uuid": "f75d1c90-cd56-413f-837b-02a92b265912", "value": "550ddb733b658b80c4e3d423100d93fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa8b729c-88b5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644307437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307437, "uuid": "ed8d240d-eb44-4147-88be-ebd8e9611d9b", "comment": "Malware payload (Formbook)", "value": "e1d39a690c8bd861d4a1c92944b71c4c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307437, "uuid": "b6014b7c-71c0-4072-8e21-49a574304544", "comment": "Malware payload (Formbook)", "value": "0373bb21f3426283c37f9c90b3a8da340ce5c53b9681016956f253424a99b20a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307437, "uuid": "f523a554-a9ed-4d03-a3ed-99db632e1c10", "comment": "Malware payload (Formbook)", "value": "b363665c99ac411711b9892e3522526293a9071b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307437, "uuid": "37074d4f-d531-41ff-b999-e07c6e2fcaf0", "comment": "Malware payload (Formbook)", "value": "f3bf4355bae25523c7d328668e6f3790427ae8d194c236089b629683543e8cf9ca28c9bc0f48fdcfa0c617c1f191e4d8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307437, "uuid": "a3d558dd-f738-4ea4-a842-987ee0f8b629", "value": "T16514011937CF5D3CD34306B90384C0A2826A5CDABD8B269170D17FFCA973E606977A69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307437, "uuid": "bae94b77-64de-4d4b-a322-c89f55e086ac", "value": "3072:VAjgaJYgxgWSj/FjCcGTLr3vGlt34Wep8u9ZbdcCgLE6wkWePM7gyZO6gihtPfM7:k7xa/FOcGT/fcIi2xAlWhg/ihtxjE6hI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644307437, "uuid": "cfd9f47e-d934-4171-9f0b-fe1e09d6c96f", "value": 191480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644307437, "uuid": "8a56df75-ad2d-4166-9843-2beac92a2ea0", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307437, "uuid": "869ea96d-e411-4c06-974f-cd366fcde105", "value": "H0678.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78dae322-88f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644333982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644333982, "uuid": "2d7e047a-82a0-4cba-9aaa-5f4b3ce961f4", "comment": "Malware payload (Heodo)", "value": "8138f36b45968d6fb79688a6c9ae4b45", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644333982, "uuid": "240e201c-7420-4db9-a820-9ed3aab046d9", "comment": "Malware payload (Heodo)", "value": "0394f985427cf865908f4b9159308de81969c44a29494667ff29efac10b7a843", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644333982, "uuid": "3719adaf-2f62-4446-80a4-40ac73051ac2", "comment": "Malware payload (Heodo)", "value": "b8620d7a47c48c3e4a9438c12c41a5de6fe43408", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644333982, "uuid": "655e5deb-f84a-47da-b0f6-65c7084f90fe", "comment": "Malware payload (Heodo)", "value": "fffd51da2be0949fa77d9d5688fdea054220fbaa930a374543d1a5feff032018a5fb6e5a07a5aee1d2fabc447a741303", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644333982, "uuid": "29627506-56a8-4b29-b9dd-6b9734fa4e6c", "value": "T188F4C0006582907AE4F930B842667BF1E93D1CB0372511D39BD069FEA6E41F1B6B376B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644333982, "uuid": "9d5c951c-b0cc-458e-afca-5a80845881f3", "value": "36d18f8cb3bee16af0421e6a936157a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644333982, "uuid": "c0fdc7a3-7c5c-47e5-b67b-92627e554b3c", "value": "12288:lBseOTwOg957PAMTEFv49thrFcmxLFwD7wGcXbtzbEOpUDlBCawsoei4:keOTwOUPnTC49LJxJwaCOpUD79oei4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644333982, "uuid": "2f751e2d-fb0c-4270-b56b-0aa9c080bea1", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644333982, "uuid": "3a5f5ddc-65f2-45a3-a6d8-ff929914f94e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644333982, "uuid": "15475476-9a16-4b99-96d1-865534bc4d68", "value": "8138f36b45968d6fb79688a6c9ae4b45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c944bbf-88cc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644317265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317265, "uuid": "9e320bee-2e79-4f32-bdb7-80229393beda", "comment": "Malware payload (Heodo)", "value": "6951adbb801a605508713607053af61f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317265, "uuid": "33b42028-ef69-401a-8d84-f84f4222b5d0", "comment": "Malware payload (Heodo)", "value": "03c83feebeac7273ae3433357a8da41f2b591f74aeeaa1d77fb8f5150009dd5d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317265, "uuid": "cc963171-edf4-400c-b481-612d71a2dcc7", "comment": "Malware payload (Heodo)", "value": "aee8bee83f553b86ce911f55d75bb8053e98da0c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317265, "uuid": "ac754506-0298-4743-bf61-efed3c0eda15", "comment": "Malware payload (Heodo)", "value": "9dd23294eb651960361e8d92845b1ee77ca0586d6f06fa1c3933b86a50e0f902d6e99915fcfafb2f6d9ef9a3fb8a6757", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317265, "uuid": "36689e7d-9e6d-462d-9afc-78041dc92546", "value": "T19393499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317265, "uuid": "0e0d31f8-c97a-483a-9bc9-bb9e4b0e358b", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644317265, "uuid": "e1a7f20f-5f50-4ac9-ac6d-747401bcf6a6", "value": 96381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644317265, "uuid": "510dc0a7-6d1c-41c1-a110-a1d796e15314", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317265, "uuid": "0c68b96f-b3e8-476c-89aa-af4448907584", "value": "tmp6347ma10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f903153-889d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644297030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297030, "uuid": "f19cbc12-cb64-487f-83ec-3314cb86727d", "comment": "Malware payload (Heodo)", "value": "2de1841414d62bce11e85daa0431f03e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297030, "uuid": "0e092b6a-00c7-4527-9a8e-7bae8aca8edb", "comment": "Malware payload (Heodo)", "value": "03d6d307d3fc4a067193b1f3cfb96bd5ccf52faf6814a5e347432c9f40bb1417", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297030, "uuid": "9967b351-b307-434b-92fc-53d10f43be9f", "comment": "Malware payload (Heodo)", "value": "ffa1ebb4bef47253b9ff13f2c0d00f0903c6418e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297030, "uuid": "a1bef2df-9fa0-4eb5-9f57-c0464a306297", "comment": "Malware payload (Heodo)", "value": "653f6f49f787004c2d461c03f84eb368cb634cb956f752546064516691440c08806c7d426c9bfba581a6df7f4248d218", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297030, "uuid": "dc38d0f2-8933-40ed-b1d4-f16f5bffca1c", "value": "T1E8D38D6ABA48CA0BD94913314EE7CBF67336BC819F5297473295B72E1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297030, "uuid": "d1a5736e-f230-4ebd-9667-6f0173099a9a", "value": "3072:jcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgDa3R:jcKoSsxzNDZLDZjlbR868O8KlVH3skeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644297030, "uuid": "aab633f0-0c71-462b-b6be-5527aa1491e4", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644297030, "uuid": "37da7d35-5a53-451e-8f8d-9c1dc0e6afc1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297030, "uuid": "1c14cda9-4389-4213-920a-b8c76ad7c033", "value": "tmpzhm2e5_y", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4861a7fa-892b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644357953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644357953, "uuid": "2f6b1ec5-e8c2-4485-874f-9d5c17f8680e", "comment": "Malware payload", "value": "e86c6c8e16bd32afb4672843ca2b05b7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644357953, "uuid": "704f4abd-f8e2-44a8-abe6-df4b1ad0888d", "comment": "Malware payload", "value": "03f2fcba0e8b0e2e310806ebc1ae55585b47369bbf65a29512ad2a2e634dbd5c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644357953, "uuid": "9e73227b-d965-42aa-a27b-9d3e1f060c0c", "comment": "Malware payload", "value": "10f3220fc602c0888fc53ea2c14edceac5234c44", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644357953, "uuid": "bf608d5e-9966-4462-86ae-c6a238f87ab6", "comment": "Malware payload", "value": "2fdecb21f2dbeb4966a7811e14dacc3e9ab67e88c483633571f86ec82b12b59b7fe21b1b7ec3ebf68ed9e4ccb4129de4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644357953, "uuid": "ec07a46e-efb0-4923-9a9e-a5987fc72c70", "value": "T106C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7C76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644357953, "uuid": "8a945832-60dd-4320-bc52-17f23c37f1c6", "value": "3072:ojcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBL:McKoSsxzNDZLDZjlbR868O8KlVH37kez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644357953, "uuid": "ada1727b-f254-496d-a806-902460f487b1", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644357953, "uuid": "361e1e27-3d0b-4adf-b92d-d59b0b8a9edf", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644357953, "uuid": "f665996f-bed7-44a4-a412-a8fd181291bd", "value": "tmpuzl6hsrt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b2223b-88b7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644308335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308335, "uuid": "30ac336f-c983-4cdf-a760-063afbda1501", "comment": "Malware payload (Heodo)", "value": "5950664ea48af6260119305f78c029df", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308335, "uuid": "5a3c16ec-e745-4089-a445-678fe825115d", "comment": "Malware payload (Heodo)", "value": "0407760e503dda15322963923a97e98719067fae2832f94f495845308bcddf2c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308335, "uuid": "1b6d693e-7564-4b16-8b3f-b2a2a07a7aa0", "comment": "Malware payload (Heodo)", "value": "6ebb3c9e52a789baadee1a254ca8e5d15354478b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308335, "uuid": "673611fe-9590-4e05-a39e-2c25682f2a1d", "comment": "Malware payload (Heodo)", "value": "f82021ce0fff6e43e8e32b9ffab31cd10eda6fac647c1c7c032bd63288bf3cc19b1cb4694238b46f0480669417817d7b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308335, "uuid": "89ece088-fac4-4f91-8788-40b36e8b3c60", "value": "T14E93499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308335, "uuid": "f09d40b7-21fd-460a-a59d-f98f532ffccc", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644308335, "uuid": "3dc291f1-513a-4101-888f-99cda80f251e", "value": 96409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644308335, "uuid": "6a6dac5a-b7cb-4151-ae65-3ee63656575b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308335, "uuid": "7827d5ba-f890-4ed6-9396-df3205ed31d8", "value": "tmprqv0odsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f36aa3-8918-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644350032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350032, "uuid": "3763555f-5da3-4f8b-8246-00247c921ac3", "comment": "Malware payload (Formbook)", "value": "38aed2534480c27c816c57ee6a369f87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350032, "uuid": "557fcc27-5170-4791-875d-82b3660fd4bf", "comment": "Malware payload (Formbook)", "value": "0418190aadd19ac9ea51c98d516f178ce5378a5d4354d44a9b49ac814b49325e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350032, "uuid": "bc17d69d-5be3-41e9-b783-6b329329432e", "comment": "Malware payload (Formbook)", "value": "3a1d97bffba30b52704e8787af93cf1d6a56e16c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350032, "uuid": "51d8cdb3-05fe-4b8d-be91-926e451625a0", "comment": "Malware payload (Formbook)", "value": "155ec8cd58895fdc3b9020a6e2da65f9f198ef276ff9becc274e11473021d47a2f5855aa359b156589bb9ac408fffc7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644350032, "uuid": "4d82690a-6ccd-4a57-aa00-6855438dbfec", "value": "T1E5B4DF4E3320D6DBC0091378EE43DD3F4AB4E9883686C7DAF1966ADF755125A2C03AB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644350032, "uuid": "29276be9-179b-4882-bc77-162c07fbea64", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644350032, "uuid": "c4efb30c-3e35-402b-a4da-fa93de367680", "value": "12288:9JRTkHmNNPF7vY3ZRL53T/DBaVp4vY7Jh28+:9JRTGmfPFU3ZRLh/ocvY7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644350032, "uuid": "2862fb8e-91fe-4522-a0ca-60307b4039cd", "value": 500934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644350032, "uuid": "9912cc8e-770d-4c4f-8a78-aadabda47139", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644350032, "uuid": "b5652e05-d71f-4b2a-a2f4-6861b8272020", "value": "38aed2534480c27c816c57ee6a369f87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e51a6b-887a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644282203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282203, "uuid": "154ffc21-42d4-45eb-aef5-f61a0194c9d1", "comment": "Malware payload (Heodo)", "value": "23ba7cdea34257d97cdad855fd98c10b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282203, "uuid": "de8b2264-0545-40be-8547-749046b6b903", "comment": "Malware payload (Heodo)", "value": "04399232d59746ed111afd20d2f0cefda2e38074de7c028ae226d85c6f75ee8c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282203, "uuid": "d27d3108-b03f-4ce9-a6c1-2250d92870bf", "comment": "Malware payload (Heodo)", "value": "487573d770b405dc170c91421190e16aaa0d56b1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282203, "uuid": "cfc1ea42-9f90-4f6e-ac68-762b870589ff", "comment": "Malware payload (Heodo)", "value": "24c85ded092778a1c715f83e9e476444a98ab2a1b20b43e1c9d056aec313052cf286d6a92e3cf8011f8c65273edfba87", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282203, "uuid": "13487ced-e412-4979-855a-5153c0043290", "value": "T14E93F15D6E5C3A0BE1DBE234CF3CDEA092251DE076B1F4BA61A17F6A403C493C156A6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282203, "uuid": "09519a7e-fa82-4692-a64a-a2859d2f953e", "value": "1536:zZRiRVq+W6/3lUp9nzSKa3Xm1WBXz7yL64i+kkfa+3gtfvjHtoxzg5bjIFbLM:zvAVq2/369Na3Xm4nC5X5gxvhoxzMI1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644282203, "uuid": "9fb53e08-8972-417c-b0df-ebc89e3a322b", "value": 94230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644282203, "uuid": "6040d45d-60c5-47cf-8d4f-68a5f423764e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282203, "uuid": "45824266-4f7b-4e08-8e03-7e62e8a3cec0", "value": "tmpx2pu3642", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c92507-88ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644339165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339165, "uuid": "2ebcad03-f96a-4000-a509-390b153f7748", "comment": "Malware payload (Heodo)", "value": "0dcb586ab119e88b59704fa6a7f6a43c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339165, "uuid": "d6f4ef6e-96a3-4934-9412-4943a19ae3f0", "comment": "Malware payload (Heodo)", "value": "044e520842974d0e51f62460a74c4d3afc98c1f4bf57fea19f0905889ed0f15b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339165, "uuid": "4fac3fe3-af62-48f0-9753-3162614b748c", "comment": "Malware payload (Heodo)", "value": "e9698b5e509bebadc0961f3c49339bb068076116", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339165, "uuid": "0fc47be1-9917-4996-b2af-cddd72fdece9", "comment": "Malware payload (Heodo)", "value": "099af56ca331d0e68a2ac578c1c117872cc0ab000c82028746a3c8985b731b9428fe7a971d31121428f1cce4cf685b4c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339165, "uuid": "3f08f8fb-ef8c-4110-927f-108c1789f52c", "value": "T1C4C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339165, "uuid": "7dfdc56f-e761-45fc-86bc-6e43d64c8017", "value": "3072:BtcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBz:TcKoSsxzNDZLDZjlbR868O8KlVH37kef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644339165, "uuid": "b6b4a1ce-e0c3-48cb-88a7-c4ad9eea2470", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644339165, "uuid": "69e37892-a202-4305-bfb5-fc501f12900a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339165, "uuid": "ea624de2-d91a-4f5d-83ed-67da53967d22", "value": "tmpp2vll_t6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a79758c-88a1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644298793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298793, "uuid": "2e75253d-33a5-4811-ade7-2732ff513b80", "comment": "Malware payload (Heodo)", "value": "466767b165f2083cb605b0e809b28fa9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298793, "uuid": "5be177f6-f0b2-44e5-b1f9-caf38904b589", "comment": "Malware payload (Heodo)", "value": "044f7fcb08cd182352688ff29e7149c807610a3236a524b988d56adc8cbb4cc8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298793, "uuid": "50e98284-62a8-475d-8d8e-dd00cb3e24d4", "comment": "Malware payload (Heodo)", "value": "328c435fceb86eb7bb5a132cd9e27504c004c4ae", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298793, "uuid": "6ef31881-034a-4c10-a913-2288dc651f3e", "comment": "Malware payload (Heodo)", "value": "f09c3e22c49736520f92b172d1ca2fa64859316b53855ff3d4d62ab85cd23cb2bd55551b85d0c830352ac1b8e9545d3f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644298793, "uuid": "8aa5ff7f-0f02-40f9-9e19-145e250846fc", "value": "T191D38D6ABA48CA0BD94913314EE7CBF67336BC819F5297473295B72F1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644298793, "uuid": "fb4f24fc-1949-4987-b7f9-2fd9d0b0499a", "value": "3072:IcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3J:IcKoSsxzNDZLDZjlbR868O8KlVH3skeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644298793, "uuid": "1e746b05-9b4e-4b5b-8b9e-c6c10aed4f63", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644298793, "uuid": "3a943394-4a94-46d2-a6aa-d87fdbcf471a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644298793, "uuid": "4a578b77-a8ad-49b8-ab7c-93c66f833ba2", "value": "tmpyzw10igx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adca9454-88b4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644307013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307013, "uuid": "7f022dfb-6c0d-4288-8798-1e9a41f1088c", "comment": "Malware payload (Heodo)", "value": "cad5f7c1e1bf8acf5fe660949d0ba032", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307013, "uuid": "5008b820-a83b-41bd-8acd-99e9b6a7eaa3", "comment": "Malware payload (Heodo)", "value": "0476fa19a76072af62582d3b005a46bbfd41936c1a40de54aa115b8b1281917a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307013, "uuid": "b69b7df2-9749-4610-9af8-51a69ee3d72f", "comment": "Malware payload (Heodo)", "value": "e6e9c0ae5af4afa97e282af96a7866b3362aaed7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307013, "uuid": "8b9bbd65-2af6-45a8-a777-3dfea9680112", "comment": "Malware payload (Heodo)", "value": "c1966c8a3f8af0e9f62383cefdfe207290ced1c0f9e36a62965d5d34121dbbde23d2675bac9548a3c86bbe24accb0b93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307013, "uuid": "9ca023b1-0be4-4405-bc46-0540ece58633", "value": "T143D429AB3A8FA1BDF17B017A6350FB44E4D27C1A9FBD25D70A86358893F2D054F18A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307013, "uuid": "7fe830a3-cee1-4e01-b822-d8442fe6bc10", "value": "bf1ebe22ec6f51f906ec295a3a5c6d92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307013, "uuid": "94da2db5-c60a-4611-b727-b2ff575aaafc", "value": "6144:x42k6LwFPw91EDbkUE39P7pyADYzqlEDFmZ4s3wADlcvIpxUIVZFoEXlbeZhp4ga:x409qDb109PdyOYzq3L3fVbeFTi40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644307013, "uuid": "5144f211-b5e9-4e84-9e68-263e04cc72a0", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644307013, "uuid": "a7730895-90bb-44c2-96ad-c24de6c4c172", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307013, "uuid": "bd4735f4-bedc-489f-8e40-16075f6e01f1", "value": "cad5f7c1e1bf8acf5fe660949d0ba032", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c70e8e3-88aa-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644302501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302501, "uuid": "8aa9f5fb-2c89-4bdd-bdcc-d7be4861b4a7", "comment": "Malware payload (Heodo)", "value": "b6ef9d210543ebc8512cf50b3457499a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302501, "uuid": "30c52d6f-ce16-4c46-b3d4-7cc4db9c93f0", "comment": "Malware payload (Heodo)", "value": "04a612f36c1f1519bc7cd040a970b30b8a6db2d6f8ae124a5df98e1a86187a21", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302501, "uuid": "ffd58f6d-a37e-4322-90a3-c636297e120d", "comment": "Malware payload (Heodo)", "value": "ef0cc5f2e34306918928226d5d3496d5bb83a642", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302501, "uuid": "8c3d87ab-ba89-4ed8-acbd-aa835be14930", "comment": "Malware payload (Heodo)", "value": "379768741d5f561ace8b44dc63d74a5e625b211db13e181231dbca681e8dad9cba8eb57a56190af9989d7a67496507f6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302501, "uuid": "72af6674-78a7-4e3a-b5c9-ba6c53b6f3c4", "value": "T16993499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302501, "uuid": "7a60069f-e577-48c3-9293-5a28d901e3d6", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644302501, "uuid": "586f63e1-ce1b-4697-8ef9-9c2317e71b6a", "value": 96319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644302501, "uuid": "7695c800-8abd-4433-ae69-7d3a02b667b8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302501, "uuid": "8c6b161f-c30d-43d6-a3c9-79784cd618e4", "value": "tmpnv5ij7en", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f1e038-8899-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644295346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295346, "uuid": "f9a5d8e1-77f2-4eb9-832f-7f089f58d1c6", "comment": "Malware payload (Heodo)", "value": "a5d502fcdbaa7ef15517563447c1c5dd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295346, "uuid": "29d35f91-fe79-4262-896e-d1ff34a8f93d", "comment": "Malware payload (Heodo)", "value": "04c9d0af24c4e91cc217b79ff3808e400a985d35d6ce12b718215c995391090e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295346, "uuid": "f8a40a3c-293c-4380-8b5a-3d6a4f7c36aa", "comment": "Malware payload (Heodo)", "value": "ed966ca3b7e46d05f9df79c2464f8d0015d005d0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295346, "uuid": "38e0c3f1-b9a5-49e5-b1d6-9a54a5f6c1c0", "comment": "Malware payload (Heodo)", "value": "6a2c192a5a950f83d96227c97d13c973d75a504e05b65f4cd5fed02aa092dc9402a0182918a8c1f4de6de3d5d3af4736", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644295346, "uuid": "a7f2900c-0809-4f5c-8c38-5c6b836cd4ba", "value": "T1FDD38D6ABA58CA0BD94913314EE7CBF67336BC819F5297473295B72F1C3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644295346, "uuid": "3d3a374b-9dd3-46e0-83c8-afa9e75af74f", "value": "3072:hcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3c:hcKoSsxzNDZLDZjlbR868O8KlVH3skeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644295346, "uuid": "80f15270-f79a-4e82-84bf-c8c725b032d0", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644295346, "uuid": "e3477de9-ca20-4b86-80c2-f5ab291c716f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644295346, "uuid": "5416c903-461f-4b46-8425-65dccc2b5835", "value": "tmpbt6poqgb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2a420a-88b7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644308356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308356, "uuid": "f6ebd3a5-dfce-4936-9fd0-cfe9b3f45d3e", "comment": "Malware payload (Heodo)", "value": "137304ac25399f015e4e594dbc964054", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308356, "uuid": "acc6c243-32e0-4ec7-873d-a35a6282373b", "comment": "Malware payload (Heodo)", "value": "0513fb11f1076cfffeb3030e7e1e4ce4c4fb7f26fd78c74425915f89ebb886ee", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308356, "uuid": "47d313a4-c8f8-4dce-afa0-6b7e8073e1f2", "comment": "Malware payload (Heodo)", "value": "e99823f6dcf8c60d01be3f2c9524fc319649f675", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308356, "uuid": "c4e853d3-92a7-49ca-8240-2d85d215790c", "comment": "Malware payload (Heodo)", "value": "ca0c17b0b1d4227986bceb79b3b28665f3b31db42206e2262dda24dce866f7bca7da912e5bdc22e227c12cb921778681", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308356, "uuid": "a0bb2ce5-eafe-4c64-bf6f-ddd4569c8291", "value": "T178C36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308356, "uuid": "91b9eabc-d702-4d5b-84dc-e8bce0aab5ef", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644308356, "uuid": "01ddbeae-e257-4b20-a54c-baee6e087db2", "value": 128599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644308356, "uuid": "1146c138-e078-47f8-b5d4-4ea094090793", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308356, "uuid": "a122a3aa-6289-4760-b6df-2fc43062f796", "value": "tmp_sukfwv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7888599e-8927-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644356316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356316, "uuid": "b41fe56e-89ca-42d2-8c0b-7e86ec8dc51a", "comment": "Malware payload", "value": "f5bb8b75fdaebc439b07110663bb8762", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356316, "uuid": "5d2daf11-06f0-4aab-9c19-eab0a35612f9", "comment": "Malware payload", "value": "054ad65a93aea08808ad988fcdd9641b08d20c3e2656c049ede34c219fb984f1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356316, "uuid": "54ae29b3-2963-4840-a238-106d29ab2696", "comment": "Malware payload", "value": "1cf14ddc5996822f9a0de334becb7a61a7212176", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356316, "uuid": "2d6c3f7a-7062-48b8-a158-b03f7553ed6b", "comment": "Malware payload", "value": "d854ecfc214bb65c711721cc9b7f5d640da12d2a37f50e55ff1a664a5e1fd7f0c38bef5c0f5f20dcede74362bf15c1fe", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644356316, "uuid": "a0b4d955-8269-4bb2-a7b9-42eb8904cf7f", "value": "T10CC35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7C76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644356316, "uuid": "5a9ca91e-e75a-4fa0-908c-aff12e28b75f", "value": "3072:DucKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBL:acKoSsxzNDZLDZjlbR868O8KlVH37keD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644356316, "uuid": "72c14876-3eda-473f-b2d1-bb13132c8638", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644356316, "uuid": "f8dd9e7c-7086-47b9-a4be-6c8ca461476b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644356316, "uuid": "56c63778-9789-4d3e-b907-34cf82e46c2b", "value": "tmpgay5e9ra", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8086e361-88b2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644306078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306078, "uuid": "db5d8133-00ed-408e-9511-996ffff762e4", "comment": "Malware payload (Heodo)", "value": "fc514942de683c23d854459f5e83cdeb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306078, "uuid": "21f91988-5d55-426e-af5a-66270fdb12fc", "comment": "Malware payload (Heodo)", "value": "0590e5596ca551c253d019e266736a08592028b523c5be3ed3c6e1f423828677", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306078, "uuid": "f32e2f5a-857a-4e26-b7ed-77840186a420", "comment": "Malware payload (Heodo)", "value": "9db00ae4882df165b30c04a02be13b8857cc59cd", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306078, "uuid": "f7966f4d-b5a5-4221-9c7b-50a64abc70d0", "comment": "Malware payload (Heodo)", "value": "9827ca6f6877061d2bb17b6e4795042bd310b9b269d966e41825286cb2ef59b960216c8fcc9cc0c2a37602801e910961", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644306078, "uuid": "1f5d7ca8-6609-4ff1-854b-2fd2f13ed28f", "value": "T19193499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644306078, "uuid": "b6dda3d0-22cb-400b-bf01-0552633552ee", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644306078, "uuid": "19943e4d-e051-46aa-9698-d2296e23f55c", "value": 97316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644306078, "uuid": "6f751b07-2e04-413c-a374-60d757700855", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644306078, "uuid": "83cca714-e650-4953-96ee-2a885bbf9b09", "value": "tmphu6stqn7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5768dcc-8916-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644349116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349116, "uuid": "b22315e9-eb36-41a3-b3ce-de164cf5ea2f", "comment": "Malware payload (Heodo)", "value": "64d32b95a24495d19a10c446a26b091d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349116, "uuid": "13d49e05-5be9-4c9b-9aea-9096e7f36204", "comment": "Malware payload (Heodo)", "value": "05dcbb79515777570d846ef7fcb48dda435a243b3d18f133a061d9c816fd1487", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349116, "uuid": "f9acf313-12ee-4829-b343-b56428d5505c", "comment": "Malware payload (Heodo)", "value": "29f36746099de86876b71aa45ca95d5b0c491340", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349116, "uuid": "bbf32723-6137-4ab4-b6c6-1d9b3780443f", "comment": "Malware payload (Heodo)", "value": "076acb7ca9a7184b5a3cf6e33aebef553e92e234dd96bb20364468257649314dfc38a28ed73752a11960fd0845ce1953", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349116, "uuid": "b1504324-e9bb-4676-83f4-42d89f3e01b2", "value": "T152C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473299B32F3D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349116, "uuid": "0d052932-8701-4e49-9c72-ae7aaf0369b4", "value": "3072:GvcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgiBV:OcKoSsxzNDZLDZjlbR868O8KlVH37ke0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644349116, "uuid": "32d119b5-fbe8-4080-9ab3-5aa35023b845", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644349116, "uuid": "33048741-1998-4c90-8e1f-541f14f6a170", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349116, "uuid": "afcbfb53-2ca1-4c97-83f4-717e53753e69", "value": "tmpo6oym15a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18a2853-8908-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644343097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644343097, "uuid": "9196c992-4274-4f5c-bf59-425fb08ade48", "comment": "Malware payload (Heodo)", "value": "1303890688f26bad957c9c52791db727", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644343097, "uuid": "78a08254-28eb-4b32-88c3-6117d1d06466", "comment": "Malware payload (Heodo)", "value": "05e4f4e0a7345b607a41ef76d6c9ff26e4fcbb19314ce828303b496b907423f1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644343097, "uuid": "2967c704-9431-46cc-8b1e-8d888c522594", "comment": "Malware payload (Heodo)", "value": "f7cb093cb23e763b3c0c98ab08d7d26f7eeeef25", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644343097, "uuid": "3b39000b-f1e3-4b73-9eb2-d118bba1301b", "comment": "Malware payload (Heodo)", "value": "c816531a5fd657c398d87145ad65bbddde5c0afaea5ae4635db0296bf57156a3313df6b38b313eaf46bc25708c9a9393", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644343097, "uuid": "8426679f-62d6-4d9d-b0db-5b4edc21e801", "value": "T1C8C35A55F685EA1ADE0823350DDFC7F9733ABC828E9683473299B32F3D76550CA12606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644343097, "uuid": "8f6949c6-47e1-4f62-bc92-04f562210c04", "value": "3072:LRcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dg+BP:VcKoSsxzNDZLDZjlbR868O8KlVH37kea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644343097, "uuid": "611554e0-ab0c-440a-8ecc-d994ce135cfe", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644343097, "uuid": "fa759826-9177-4003-a277-f531369f2a93", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644343097, "uuid": "8c761585-5a2a-4c85-87c7-5819b847b3a2", "value": "tmpv0g6ps2j", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e9cc805-88d6-11ec-9275-42010a9c0029", "comment": "Malware payload (CobaltStrike)", "timestamp": 1644321375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321375, "uuid": "86a57830-acd4-464e-a550-f2840d3b15ba", "comment": "Malware payload (CobaltStrike)", "value": "cddf448a3e47da1ac74403b548f0d74a", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321375, "uuid": "437d8ce5-536b-4420-a264-436e2c227f64", "comment": "Malware payload (CobaltStrike)", "value": "060d8553ee4380ee34f61dc730af53bf0d0827dea13103d0b0d12a8d29ad0228", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321375, "uuid": "55739314-ffab-4d3b-b21d-08c6070f6f7a", "comment": "Malware payload (CobaltStrike)", "value": "1e39e042e5d10c24b86cad93472a18e7439dca87", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321375, "uuid": "c07b94e9-bd4f-420f-80b5-7e89b2b7c114", "comment": "Malware payload (CobaltStrike)", "value": "20a80490fe4501f90b9668fe267d16bffedd7a6ff3cf7ebc778260e5b3d8857f79dbe2b743e024cd8a68fdf7c0635ef9", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644321375, "uuid": "eea4f4fc-4342-474a-9eb7-ed183b23b36d", "value": "T18964C0B9A5338856CEBFCB396B32D97E8F195376E3073A3400C8771D04C0BA94A55A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644321375, "uuid": "2eb0ea02-13de-43b4-afe6-2681cc7a1e5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644321375, "uuid": "8c2c943b-6077-40a6-be36-4080e8f176be", "value": "6144:cyBjAdHfGS64N5uEj9GCvlYF6frISMUIYumO2A8:cyBjApegHvS6fUJUIYuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644321375, "uuid": "c104f800-37f7-4ff0-b57e-9b63273d2ef3", "value": 316928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644321375, "uuid": "bcd40750-b41a-4dbf-b42c-d1cf2af251ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644321375, "uuid": "6b702cf2-3418-48a7-b8f0-36a040bff8db", "value": "OAxO1hxDAf3Kvmj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb54cd0-88d3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644320243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320243, "uuid": "b101cb49-d9fa-4f62-b912-f44708ac6ccd", "comment": "Malware payload (Heodo)", "value": "e6abccefc8f29ee145bd2fd36ae31c01", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320243, "uuid": "fd5f5f68-02a0-4f86-9b08-7890dcbbaa99", "comment": "Malware payload (Heodo)", "value": "060f70ce67e94eb8840d73549fb11ee12a3f3482ab78f9495811e1aedefc247d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320243, "uuid": "02c03abc-2d0b-4314-b6dd-2d38d47a1e85", "comment": "Malware payload (Heodo)", "value": "6256e5a97e5e8846708398be2faf8293ae03b2e1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320243, "uuid": "84ee9157-06ed-482a-a383-3fb27419a92d", "comment": "Malware payload (Heodo)", "value": "a59807f262fd30a01b2cef55bcd9c906190f670c817ea5e231b2060b19a019dd4abb7f1f688ce0e8eec5c705d963e493", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320243, "uuid": "0f09dac5-060d-4fef-a86f-45cd72ef412e", "value": "T14AC36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320243, "uuid": "83230f01-4010-44dd-8b8e-1705f529b995", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644320243, "uuid": "5e940564-0ebd-4d5a-90e3-9c5f0bd897c9", "value": 128170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644320243, "uuid": "2d4fcaa4-791b-43f8-8880-f28149f6d3bb", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320243, "uuid": "22842b17-106c-4d84-87c2-09173f6a311a", "value": "tmpfurlx3iq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40fe519-889a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644295910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295910, "uuid": "b154bd02-65be-4bc1-92f0-25a1318c4ddb", "comment": "Malware payload (Heodo)", "value": "3b42a00028845adb92eb6f8ba5cce1a1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295910, "uuid": "ffbaa336-553f-4744-b42d-2a78e5625ac6", "comment": "Malware payload (Heodo)", "value": "06688199f905f6d41c70e28f2547d3c4aa6e23dc04b14294ea2b4d02088646a9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295910, "uuid": "d153f776-4ea3-427d-9b60-9b946d0438ff", "comment": "Malware payload (Heodo)", "value": "bd5696777dfc0f406e714216ee2ba79d9843a892", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295910, "uuid": "fdab522f-80e2-4015-b8cd-dc23093092ee", "comment": "Malware payload (Heodo)", "value": "57ba4eae71048d4db71db453c04dcbf7d7e23badce0561ffd20298b54f7ecf5e3cccc81053281ed07a19594b50c9c095", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644295910, "uuid": "edcc1e94-82fb-46fb-b746-d1b84d913b7b", "value": "T184D38D6EBA48CA0BD94913314EE7CBF67335BC819F5297473295B72E1C3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644295910, "uuid": "bb6e3fbe-8f63-44d7-af5f-8e5c29083e96", "value": "3072:0cKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3y:0cKoSsxzNDZLDZjlbR868O8KlVH3skeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644295910, "uuid": "1b8725a8-b485-47c2-8f77-ca644e936a41", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644295910, "uuid": "4d0760d1-e6d0-46b1-b5e4-20feb96a2096", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644295910, "uuid": "340eb6d3-66f1-4036-9f70-9c5ace4dd1a9", "value": "tmpi91b38lg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "535dae8f-889b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644296124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296124, "uuid": "3104c2a5-7254-4960-9abf-9350d9f47899", "comment": "Malware payload (Heodo)", "value": "d7a95437e93a87ad3d000ae6f9c5f1ee", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296124, "uuid": "c0a72436-9add-4230-a178-b4974692e196", "comment": "Malware payload (Heodo)", "value": "068125e9ac6427a8f84e9fbb1252bbd51921b1eb994f714c9c79da2435d5bcad", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296124, "uuid": "98afdccd-6651-436b-add5-3f447ccb6339", "comment": "Malware payload (Heodo)", "value": "76ff5e7eed9fa7a79b1b35cffa4ecd543f40af0c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296124, "uuid": "2a64dfe3-aa67-4281-bd82-2faf9871baf3", "comment": "Malware payload (Heodo)", "value": "346ec67d10782e0c9bb1f9172b699fa31984adecf9cd008fdd78211ac3eea500b59957d8cc45796e5a1b677cff0a8aed", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644296124, "uuid": "dc7ce7f7-fe26-455a-a238-62e1a9c8b9e8", "value": "T16CD38D6ABA48CA0BD94913314EE7CBF67336BC819F5297473295B72F1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644296124, "uuid": "ac7e80b4-eb61-4ff3-9f06-69f6c76c21c9", "value": "3072:TcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa37:TcKoSsxzNDZLDZjlbR868O8KlVH3skeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644296124, "uuid": "e83cff59-54a1-46b7-87e6-d14478feb7ec", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644296124, "uuid": "84a5cbfb-2080-4252-a185-903cf447e2e4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644296124, "uuid": "3a5dfe8a-b29f-4822-938b-067fe8065fb9", "value": "tmpowp32hx9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1374f53a-88b7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644308042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308042, "uuid": "dc30c24f-3879-4843-a130-a008d3c3bd58", "comment": "Malware payload (Heodo)", "value": "b05a8d6dcda0e819d537574d4d2a2a96", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308042, "uuid": "4736d102-3b06-4018-9809-7cc380ee92bb", "comment": "Malware payload (Heodo)", "value": "0690dc2ba19e9f7558cf90b5d459709b6f8cb31863839f0a8aee6536b551a9ca", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308042, "uuid": "70019bc3-582a-42b3-a7d6-c9c6386081a6", "comment": "Malware payload (Heodo)", "value": "600bb338297b495f3dc8b0e85801792dbb0b359a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308042, "uuid": "d247e07e-0709-4fdd-92ab-06b28eeed802", "comment": "Malware payload (Heodo)", "value": "334b525ff7f7d991ae26cc053d44c5ef63b759377d92faf820a0f5b524140d3b8d64ba36ef22df6fa2e9aebe9d1194dd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308042, "uuid": "0b46b39e-3a90-442f-a9b3-df4eea7e600e", "value": "T1ED93499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308042, "uuid": "389e7bc0-8b9a-4e89-8b3d-b98385ba1302", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644308042, "uuid": "d30367ef-daa8-4021-af11-8447363cd4d8", "value": 97070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644308042, "uuid": "4c498ca8-eed9-4e00-a790-8ab9c48dc3cf", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308042, "uuid": "19487b20-66dd-4584-abd2-3c54c282bb6d", "value": "tmphd0jlr5t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39398bfc-8904-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644341177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341177, "uuid": "5fcea68f-780f-45d6-9398-e8d0992da876", "comment": "Malware payload (Heodo)", "value": "166a7b7e8d095254472f9b3f545f1de6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341177, "uuid": "82e681f0-9bad-4781-8b81-5b7f6c9fa953", "comment": "Malware payload (Heodo)", "value": "0692cef3dfbf621fc7c321af1ed5e51427f142de202ac5afbcb40c025bc1df12", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341177, "uuid": "f5dcdd4b-cc1e-4064-a549-6ed9046dc2d4", "comment": "Malware payload (Heodo)", "value": "22917bea882b98a4b2e251eed8707ae1920b6fae", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341177, "uuid": "4a368cf3-afd9-444e-ab9c-ef6cd9046140", "comment": "Malware payload (Heodo)", "value": "b62285b41a6991fb308f30ff1636d11146bc5399496fea80610a68ff77fb2dce57cd216b551df6f4b2291ea071eeb289", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341177, "uuid": "301a0cad-2e3b-458b-8ec0-50976eee7f69", "value": "T1BCC35A55F685EA1ADE0823350DDFC7F9733ABC828E9683473289B32F7D76550CA12606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341177, "uuid": "f92e3ba1-c4f2-4562-82a4-cead641ba4ad", "value": "3072:KNcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBQ:YcKoSsxzNDZLDZjlbR868O8KlVH37ke0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644341177, "uuid": "b827d159-b1a3-4fd5-ab80-79551802fa99", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644341177, "uuid": "0e7fc7de-bc84-408a-bd70-6a41a70a39cb", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341177, "uuid": "62bc8876-36f4-465a-915d-651c842f0615", "value": "tmp0pw2kg4y", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8b10b9-8890-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644291304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644291304, "uuid": "30bc9099-7448-4878-bc8a-bb14e14450e5", "comment": "Malware payload (Heodo)", "value": "e686948873242b018b786d790ddc8f09", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644291304, "uuid": "38351192-f28c-4451-b670-fc032ddc30e5", "comment": "Malware payload (Heodo)", "value": "069e78e45fa62605f46a912b655345fa3c7d4603305b0502a0c687116fa46f1e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644291304, "uuid": "ac95bbf6-cbf3-419c-8f93-81e03cd566bb", "comment": "Malware payload (Heodo)", "value": "359280501aac3e310af0817e7d5f3d8c1bb933b5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644291304, "uuid": "c8785f73-31da-446a-aadd-f8fe7e0614ce", "comment": "Malware payload (Heodo)", "value": "ae3eedcfef2ec5aa98455d8329c03b5553ea40acba0f1fecde8a240072f267ff2d75b0b6fcf28a972920a0d716fbd86d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644291304, "uuid": "a00db40e-8e4b-45d5-89b1-9505ccd8a46c", "value": "T180D39C6EBA48CA0BD94953314EE7CBF67336BC819F5297473295B72E1C3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644291304, "uuid": "07a8274a-52f7-4f8a-ab88-56d4c06936fd", "value": "3072:ocKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3X:ocKoSsxzNDZLDZjlbR868O8KlVH3skem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644291304, "uuid": "8d95851c-0d0d-429c-9d24-ae31444e4a54", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644291304, "uuid": "e98bfeb7-cb38-4491-bd3b-2fb50d2b7d20", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644291304, "uuid": "8d22d2b3-de83-4fa0-9682-0063636a4037", "value": "tmps30bnima", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78bf25c-88a0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644298520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298520, "uuid": "a08b213b-a66c-4d8f-b4b0-3e01a583997f", "comment": "Malware payload (Heodo)", "value": "f924f0ec96be996334797c7134cbd454", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298520, "uuid": "3bdb20de-b906-40db-8495-a430a226c628", "comment": "Malware payload (Heodo)", "value": "06c512509fc802d43da8006bdec19ce99b5e5096186038cd65f4ab877555730d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298520, "uuid": "f9413033-317f-4706-b87d-d505b3ac8b63", "comment": "Malware payload (Heodo)", "value": "72964b882068adb9124cedf5e7dfbee26614ebe9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298520, "uuid": "2351f42c-729b-41c8-9e6d-fd20a82fba19", "comment": "Malware payload (Heodo)", "value": "48b47c79f096741c51f10959ee4b428be12f98b17b3cd32674f44ae97bd02005c3d9932f0f8bdcaf45b294b286f2aab1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644298520, "uuid": "be1c92eb-63d3-4a04-bc62-6622237f1c00", "value": "T1C8D38C6EBA48CA0BD94913314EE7CBF67336BC819F5297473295B72E1C3A590CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644298520, "uuid": "a4c3ad04-0afa-43e9-aa60-712048517bc8", "value": "3072:AcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3r:AcKoSsxzNDZLDZjlbR868O8KlVH3skea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644298520, "uuid": "d4c04b14-8da6-478c-bd54-eeefaec56bb7", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644298520, "uuid": "1584bf10-4204-4d38-baa7-884f249b258d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644298520, "uuid": "42069659-1576-4baa-9387-7f77e28f6d19", "value": "tmpsgt5o_bh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3eb3f8-889f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644297751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297751, "uuid": "ec7013f4-b04e-4ed3-9fa2-d1ef0e665259", "comment": "Malware payload (Heodo)", "value": "61b0af4694ee453d357c6dee391dcf03", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297751, "uuid": "1761175c-d562-4de2-9348-557221e9ac46", "comment": "Malware payload (Heodo)", "value": "06e25cc442dc27d96f868045f0ce1f7b091daf94ba27c2b44204edc9ce4ace37", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297751, "uuid": "8f8985b0-6252-4852-a31f-fb945db96f34", "comment": "Malware payload (Heodo)", "value": "35d12141b3d6e7d5c314fa24e942f95f2c6e53f3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297751, "uuid": "2ace5b31-1bcd-41de-bc32-89728ff0c79f", "comment": "Malware payload (Heodo)", "value": "0101b2f6b7e4c1fc0b19ee795605c038458d6aa3e0aa1cab4b0ddacde20312b5222bf393def7f5d8123e92a9d8466c99", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297751, "uuid": "f4ecee44-887a-4375-84be-81afad3d4e40", "value": "T1F8D38C6EBA48CA0BD94913314EE7CBF67336BC819F5297473295B72E1C3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297751, "uuid": "823e6a3e-16f7-4b4e-942a-059b4ec30825", "value": "3072:JcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3b:JcKoSsxzNDZLDZjlbR868O8KlVH3ske+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644297751, "uuid": "6f8fb615-0ddb-45f6-a202-a4047f897a7b", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644297751, "uuid": "5e1eb50d-b396-45c6-b634-811f1fa14907", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297751, "uuid": "1eaec62d-043b-42ff-98df-3d302e060018", "value": "tmp84kz2k5o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db202cf-88f8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644336192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644336192, "uuid": "1c5ca8f6-7f6f-4cc7-b6c4-af05a4ed4bf1", "comment": "Malware payload (Heodo)", "value": "edcad4e130ca34316d9b8596fc10d133", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644336192, "uuid": "c79a41a6-00f4-4a95-a6d8-ef826fddfeb0", "comment": "Malware payload (Heodo)", "value": "06e2e9107e02f53b91aa45f5693e39fe38df414b04b72aed2c16d232b7eec4f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644336192, "uuid": "3e10fa40-2665-4220-9c0a-90308fcabe12", "comment": "Malware payload (Heodo)", "value": "7772b7045607fba1d0f16d454cd82e02d2f2dd84", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644336192, "uuid": "e5a44eb2-4286-478c-b706-8eab1e468dab", "comment": "Malware payload (Heodo)", "value": "3717ab1288cffe285a2c0d01255b18c308cd4691d571a2461c6beefe5a095f81711d25ef2312ccf9f1a1a688335a1fc5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644336192, "uuid": "65fca57d-5ee4-4103-8379-1d44433ee802", "value": "T168F4C0006582907AE4F930B842667BF1E93D1CB0372511D39BD069FEA6E41F1B6B376B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644336192, "uuid": "d54c29f4-991f-4c70-b048-73a21f6b31c0", "value": "36d18f8cb3bee16af0421e6a936157a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644336192, "uuid": "f354cdb0-cddf-4709-a9ea-504a143cf038", "value": "12288:lBseOTwOg957PAMTEFv49thrFcmxLFwD7wGcXbtzbEOpUDlBcawsoei4:keOTwOUPnTC49LJxJwaCOpUD7voei4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644336192, "uuid": "d1acbbbc-efda-410d-826d-2da81af64edf", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644336192, "uuid": "93d8f354-8f27-4aee-9871-6a0d2716b144", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644336192, "uuid": "2f57efc9-5b1e-4486-8268-5430028272d6", "value": "edcad4e130ca34316d9b8596fc10d133", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226f171a-88c6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644314510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644314510, "uuid": "29abaa71-4848-4293-8aff-76f6f27674af", "comment": "Malware payload (Heodo)", "value": "3f9f32e2ef67ccf60b0e6e9b1ec75e93", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644314510, "uuid": "f43407f0-bd61-443a-b741-5c6a946ccd3a", "comment": "Malware payload (Heodo)", "value": "06e7dc63082906bc5680525f1ba4c0afd17ef6dceff0175747ee51c3237a78e3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644314510, "uuid": "66f10610-8a0a-44d6-92f8-4336501f0c85", "comment": "Malware payload (Heodo)", "value": "188d316e2983b6b4fc3a0973981019bc03480737", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644314510, "uuid": "28b7affd-41c1-4c80-b112-8d634ec8fb41", "comment": "Malware payload (Heodo)", "value": "dad967c84f38f42a6bbc798226ec4200d2908cc1613149ca85b164fb4a5ad26a795b7de96290719aa7653ea0cf47d4ca", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644314510, "uuid": "b7b9c6f7-4351-4d84-a446-406903cb44e2", "value": "T1A693499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644314510, "uuid": "c0741cf3-2662-4ea2-a41f-9b4558c81ace", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644314510, "uuid": "86630e56-8088-4383-b84f-a459a2eb100b", "value": 96652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644314510, "uuid": "938294be-d427-43c7-a134-072bacb53417", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644314510, "uuid": "2dec2814-6df1-43df-bd1f-43db131870d0", "value": "tmpft42n8n6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "975271c5-8881-11ec-9275-42010a9c0029", "comment": "Malware payload (N-W0rm)", "timestamp": 1644285071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285071, "uuid": "bdbecd8d-7759-482f-b992-2f0c26b4955f", "comment": "Malware payload (N-W0rm)", "value": "86cfe8e46803dbdde00c99fe67419a64", "object_relation": "md5", "Tag": [ { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285071, "uuid": "69b6dd53-aba9-4c63-8e85-56051eb3fe66", "comment": "Malware payload (N-W0rm)", "value": "070b75346e271a5545b5e80cc5733687f77b135a0e82e25f3fd1ab21d31526cc", "object_relation": "sha256", "Tag": [ { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285071, "uuid": "3d65c5f3-7c29-4c3d-a505-b353b33b2e9d", "comment": "Malware payload (N-W0rm)", "value": "b5b3dd71bf28cee7e36a8b5411e63f9abf353cea", "object_relation": "sha1", "Tag": [ { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285071, "uuid": "9a997e15-a571-4ef8-9b62-b21b4b1374eb", "comment": "Malware payload (N-W0rm)", "value": "e03e892c33d79ba875a817570ce8fb9e56e9d0c4f6ea4d8a43eb533a947a64bc8e4cb328b2848fcc83474fb993b9547e", "object_relation": "sha3-384", "Tag": [ { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285071, "uuid": "ac223223-dba7-44dc-86d6-02c85ac99907", "value": "T13983B1580F9CA67A1B77802F8390BA732CBD26E7176D4792FF7180719082FA6751E1B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285071, "uuid": "484ca72b-cc7a-48c0-ab12-e651c6b29979", "value": "384:qu1HXm/h4l9lfuFRkp/f4i5lEeWe5e16eeeJeteyeseke8etPpr:PUeWe5eQeeeJeteyeseke8eHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644285071, "uuid": "ead351fd-14cf-44d1-b241-fbd0e29b499f", "value": 83466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644285071, "uuid": "9764f1af-e7a0-432b-a289-a697d07c92e0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285071, "uuid": "67ff1d08-2e4a-460f-ae22-6f6453e4d09c", "value": "CENBXDAVRJPNARLDAAOUB.VBS.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd9652f-888e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644290717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644290717, "uuid": "28fd7bb7-4508-4290-bc94-3ebf8c1d10d9", "comment": "Malware payload (Heodo)", "value": "ae24fda1a6262671dfa67b4ad3163cce", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644290717, "uuid": "4a323f63-8f90-4836-8231-ba3de2527281", "comment": "Malware payload (Heodo)", "value": "08123d5a98767761c6e997dfa529a39eeee18eb42f7bc18d508e610e1e49e64e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644290717, "uuid": "b992914a-4e74-4828-9570-e3173f9244a8", "comment": "Malware payload (Heodo)", "value": "4e1980f4897ba8760ec8c00f5817abc6a65b200a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644290717, "uuid": "83c78e86-f754-4940-9b39-6649fe77af85", "comment": "Malware payload (Heodo)", "value": "a67f319b18b8330179245851ea76542f65135b3575792eaa1d9c572ddb3be3501631265f5e11b03f5d0a47cdac44a53d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644290717, "uuid": "689c311b-acff-4350-945a-e59aafa29513", "value": "T11BD38D6ABA48CA0BD94913314EE7CBF67336BC819F5297473295B72F1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644290717, "uuid": "09d1352c-80b6-4b19-bde0-f1ee65b29893", "value": "3072:McKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3s:McKoSsxzNDZLDZjlbR868O8KlVH3skex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644290717, "uuid": "1adcb879-ad97-4660-9b5f-01f52d21f4eb", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644290717, "uuid": "691543a5-f226-4544-803a-f0ad61db5d42", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644290717, "uuid": "379be170-76c4-44f7-97c0-718438256d0a", "value": "tmpcwwt9j99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c29ca9a7-887a-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1644282137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282137, "uuid": "62f9921e-98c5-4951-a954-19c98b7f040c", "comment": "Malware payload (AsyncRAT)", "value": "b16670245eb398f0c47ec3cdc041d309", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282137, "uuid": "902fa5f3-5ad4-4980-97de-f68e08c36882", "comment": "Malware payload (AsyncRAT)", "value": "08458f4ff992abf382b02ad28a752a12d26af5cdccf85b49e403a4a8e3aaa49e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282137, "uuid": "d8df3740-31d9-4c72-8530-170e0c2fec67", "comment": "Malware payload (AsyncRAT)", "value": "42f792f2af99d896fd87d377c2abc6e6ea2e2d0a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282137, "uuid": "314c87fb-45d3-453e-a745-022313722bea", "comment": "Malware payload (AsyncRAT)", "value": "6cd7de69d0913f140c10c5eb2904d6c76bf52d21f4b12925a9c05880faeada9b088714fb150c20726e1404a4ec272977", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282137, "uuid": "fedeb04b-2b09-4579-b184-7ca01cce1949", "value": "T16904E16737AA72A2D2BE0F79FD75C3004779F88028E7D61E6B0080D941A77509694FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282137, "uuid": "a7e405a1-b42b-47a4-8237-b3228e79a305", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282137, "uuid": "00e34995-6e99-4f18-9bd4-b6989839dad1", "value": "3072:vUqeWTSLuwKs4dA0A59xxaPLbW8ZKOAHhT67UKDw5tnom3K0d3f2JDpbc97Br9pq:s5tvJ/xaXxZRABT+Dw5tnocoJtmP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644282137, "uuid": "3a15dfc3-a648-4d27-8c9b-0d35208f33e9", "value": 181760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644282137, "uuid": "bc110d21-9e82-4626-8d33-783045574624", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282137, "uuid": "84b05f50-6ea5-468c-b0f0-2ede19f13bc7", "value": "SOA#2612226.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb8878a-88b6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644307977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307977, "uuid": "ab5a1167-982a-48a0-9caf-10378930b8cf", "comment": "Malware payload (Heodo)", "value": "2c2a14c9d5050b4d0e9892ead7aa8975", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307977, "uuid": "c8abeee3-2973-47d8-af85-9de10b0dca16", "comment": "Malware payload (Heodo)", "value": "0864d8f13cd46ae594a57d50af2526adc6b3528ac70b752ee63eabb7f580b1d6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307977, "uuid": "f423cdee-135c-4841-aea3-ff25ab19cdf2", "comment": "Malware payload (Heodo)", "value": "4196fb5f4b1fc793922b6eafc1ad1463f7702fe0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307977, "uuid": "22fe6e3e-d1fc-4809-961b-ea7c8d07ce6d", "comment": "Malware payload (Heodo)", "value": "2537f4ecfb3c5b7d3c3e296c4ce6abe900d2106ea054028ab824d40b65f90333d6946580ddb23a0e19b38b5323479de2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307977, "uuid": "6d0ee4fb-db7e-425e-b5e5-e130f6fc7201", "value": "T1BEF4C0006582907AE4F930B842667BF1E93D1CB0372511D39BD069FEA6E41F1B6B376B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307977, "uuid": "774ced0a-5700-48d8-877a-c632b9c8a401", "value": "36d18f8cb3bee16af0421e6a936157a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307977, "uuid": "78096b92-273a-475c-bf6f-b2732db219a9", "value": "12288:lBseOTwOg957PAMTEFv49thrFcmxLFwD7wGcXbtzbEOpUDlB3awsoei4:keOTwOUPnTC49LJxJwaCOpUD7uoei4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644307977, "uuid": "a96f66ad-0c1d-4dba-bcc8-ce8123792789", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644307977, "uuid": "0fc3578b-ea68-4a9f-82bc-3c3992a44f2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307977, "uuid": "b74fe4fa-14b9-4715-943f-a7250f010c19", "value": "emotet_exe_e5_0864d8f13cd46ae594a57d50af2526adc6b3528ac70b752ee63eabb7f580b1d6_2022-02-08__081251.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a334f94f-891e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644352522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644352522, "uuid": "ad3a468a-a969-4dbe-9499-0a5c31d57df8", "comment": "Malware payload (Heodo)", "value": "f73e27acb16208bb670ddd2417bd1374", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644352522, "uuid": "13c1b800-eaa0-491d-801d-e51d8030a261", "comment": "Malware payload (Heodo)", "value": "08b9675a43c84cc01363116e2a620f4495bfe7ca590cfb20b2147fd19e302182", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644352522, "uuid": "0fd3cd17-1d27-46c5-bb7d-60320f09a8db", "comment": "Malware payload (Heodo)", "value": "51f337653e80e48105898ce393550debdbc828f7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644352522, "uuid": "75a22184-4981-4585-89fb-b533e83991f4", "comment": "Malware payload (Heodo)", "value": "a0ff6b2b53e2fa878313421f1b8610088d5b0511a7f6f38fd2021f654561364418d8137cfbf54a43e050dcad8e852a6a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644352522, "uuid": "a84133fb-3742-4242-be86-b1f11fcf1a5c", "value": "T1E0C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644352522, "uuid": "1d97bbb7-df15-4ebb-95d1-95cd574ebca5", "value": "3072:/IcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBl:QcKoSsxzNDZLDZjlbR868O8KlVH37ked", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644352522, "uuid": "88f54469-6342-4483-8c0c-048a5d97ba64", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644352522, "uuid": "2b60a0b3-42a0-4b18-b27c-d0e4c8db491a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644352522, "uuid": "f8894e7e-0c1d-40f3-869c-0e8985448c7d", "value": "tmp9otsvwcv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d0683ac-88b5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644307280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307280, "uuid": "0a7d45f8-bbed-4bd3-b6fc-2d05f5abf530", "comment": "Malware payload (Heodo)", "value": "b793506d5fde0ec86b6dfd69ab6724e3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307280, "uuid": "f9fc1db7-37ff-4bb5-bb9e-c40d05f6cc2d", "comment": "Malware payload (Heodo)", "value": "08b975ec7b583158e4690f77a080f8296ee4b87e97d9d7b2588688961b55349d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307280, "uuid": "57c8e67c-a1cf-4a97-a45e-f7783c93b048", "comment": "Malware payload (Heodo)", "value": "8607b9cb06239a04d523a012dce30d78dadce562", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307280, "uuid": "68f4b109-ad0f-4e71-8d47-451fcc7e7288", "comment": "Malware payload (Heodo)", "value": "22b40715bf5b8d0825dbed595a6e921827e4e59ce999039f5b9302bdc8bd3a357e38cf3075fd8e8e33bb79e3675562b9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307280, "uuid": "fb3ac8c2-9584-4d2a-9b81-9f22cda8ac43", "value": "T1FF93499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307280, "uuid": "174e7c34-e301-42c0-b85b-19d116fc4cf8", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644307280, "uuid": "a7c2df0c-362b-4e9e-a236-3c0b47a98583", "value": 97022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644307280, "uuid": "de429b38-9a5d-4fb3-9196-0cc5d31e30a1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307280, "uuid": "57f2e446-2a5b-4443-8994-f8c957d650a4", "value": "tmp504prvri", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b28279a4-8912-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644347393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347393, "uuid": "8aee3260-9ee1-449d-9564-40157a9b361b", "comment": "Malware payload (Heodo)", "value": "9ae0cc901c0c34bf3359c47c97d16e04", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347393, "uuid": "b53e1716-c63f-48af-b94d-27a462a820f2", "comment": "Malware payload (Heodo)", "value": "08fe2f0f27fa10eca846a9083c3c32e15b0629f3ac786f5e4360d0d37400c806", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347393, "uuid": "ef390c4b-8783-4b42-85d1-fe7e0f1309c7", "comment": "Malware payload (Heodo)", "value": "e9d02ef80dd22e5f907342eac8a642ad9251b41d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347393, "uuid": "dba1a6d5-9d3c-43e2-b470-2ceb0c5034e7", "comment": "Malware payload (Heodo)", "value": "ccb7b09e3d3325bdc8b5864c708adf249f30ff9b27f19f162e2312248c003d42770fccccbefa85896d8bfe7e3e42c443", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347393, "uuid": "48b88964-ac06-4231-9032-92e728b7bad2", "value": "T1C5C35A55F685EA1ADE0812350DDFC7F9733ABC828E9683473289B32F7D7A550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347393, "uuid": "06ec6af4-9443-4d8a-b6c7-5777dcb3fdf2", "value": "3072:d8cKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLB2:OcKoSsxzNDZLDZjlbR868O8KlVH37key", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644347393, "uuid": "94852dc2-39eb-4ba2-a51d-e8a397041b58", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644347393, "uuid": "147a8d20-d683-4120-aba5-e05880aad159", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347393, "uuid": "38a07ad0-39f2-4754-af29-8e14165ae6a2", "value": "tmprpgvq2di", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e539adae-88f4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644334594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334594, "uuid": "618553bc-38a6-449d-9852-5e07cbdc3418", "comment": "Malware payload (Heodo)", "value": "c36ca4a3baa146fac446406ae07c7bda", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334594, "uuid": "e9e869d4-6429-49f2-824b-de0685bdbc6d", "comment": "Malware payload (Heodo)", "value": "09379323f714cde120fcef817bd102f0e73374dccf2b1eb82bd286d4a13b6abe", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334594, "uuid": "416ac43b-913a-4df0-8474-92ff9da011d3", "comment": "Malware payload (Heodo)", "value": "1765c615b2e1e961a2a923b0a62ecf6242bb4c77", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334594, "uuid": "d5bb665d-8487-4b96-8deb-4e6d80c15e81", "comment": "Malware payload (Heodo)", "value": "3c2577c128b85fdd9b3fbb0363b7f0dc99bacfec4ba1005b193514a1d80c1066c03f13c8a1db094e8c4040657cf62f65", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334594, "uuid": "e0520474-87cc-4169-8aa1-cc5be8a5c106", "value": "T1B1D38C6ABA48CA0BD94913314EE7CBF67336BC819F5297473295B72E1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334594, "uuid": "9960a894-1aa1-42c5-9c7a-71e9379ae16c", "value": "3072:9cKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgDa3A:9cKoSsxzNDZLDZjlbR868O8KlVH3skel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644334594, "uuid": "f048ae06-c5c9-435b-848f-329e2e4d0c66", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644334594, "uuid": "bc41c4fa-2f46-4cef-a9aa-6e13d0544a40", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334594, "uuid": "299a9d96-29f6-436a-a305-ff8b25185d0a", "value": "OMICS Online.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7780c1f-88da-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644323350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644323350, "uuid": "40787bc9-1c37-4bf9-a7d0-46c05e4e72a7", "comment": "Malware payload (Formbook)", "value": "e1a8179c5c5582eefb8f3f86d4916268", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644323350, "uuid": "e0e0ca07-3df4-4bb9-86b1-07e06df98c43", "comment": "Malware payload (Formbook)", "value": "096db373c5317c715d2cf539a69f3c17420d8b91914a62820776479b41683911", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644323350, "uuid": "376d8a06-f33f-4512-ab3b-aad95a97e9d6", "comment": "Malware payload (Formbook)", "value": "56bb02c73f0ab7ca6d00e70d8e1db14918f4a239", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644323350, "uuid": "bbbfb29b-5764-4178-9103-508d575cfda8", "comment": "Malware payload (Formbook)", "value": "0106f58de22da1fd40bd345363b420f07dda3e5b0b6f50cd46a32ee3276129378a804a659dccae77ec59d98a340d0ac7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644323350, "uuid": "66e256ba-a14f-4ace-ac6d-ae040ed69613", "value": "T15CA4237DA28FB9D829242FDE7D0990061136661C2BCD68FE979F7233088CB9C5A1517F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644323350, "uuid": "44c9f2af-4a6f-4e5b-b81b-20c227384689", "value": "12288:vbCHPEIJc9KPkGd4bjRGc8A/pCNQEbliALKz+P:vbCHsmc9eDKbdGxVrb45i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644323350, "uuid": "4b2a4053-99ca-41f1-b126-781553617afd", "value": 460776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644323350, "uuid": "8d8d9bf2-305f-4e9b-b872-f37f59f96133", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644323350, "uuid": "2d4186ee-4ac7-4c38-a248-fbb8f57526ff", "value": "1644306938.Vfc11Ibc3f4dM648018.dynamene_Proforma Fature.09827262726.PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6795dea5-889d-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644297017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297017, "uuid": "93ce0831-ad67-4577-97d7-0b6ad23ec422", "comment": "Malware payload (Loki)", "value": "8a1fbb2c5da547e38b564cbaee6d3af7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297017, "uuid": "4832e167-da55-4dc7-af03-ee28b0e6d14a", "comment": "Malware payload (Loki)", "value": "09be7801c1d01256f48f6c72beb080dc5947487b3e54260a2d5b16ad127e5091", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297017, "uuid": "ebdba5d5-233a-4a51-aecd-72779b3ccc8c", "comment": "Malware payload (Loki)", "value": "46302439cabea8a30ead04508440f192763dab9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297017, "uuid": "d502d732-8f5c-4610-ac0a-a7be9322d025", "comment": "Malware payload (Loki)", "value": "7d37c496265c5175c07490b3f0677230de8d0957270a33ccb9838b21e14d2911d0215d6d37a020162cd346aee143e842", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297017, "uuid": "953bda42-0ffc-48c4-b043-a0a2027762e8", "value": "T11605BE66F3918537D17329388C2A57749939BE102D28D8C63BD8AE0C6FFD2517B262D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297017, "uuid": "3884afc4-77c9-425e-971d-ef0a31cb0f41", "value": "4aa9a3b6508cd1bdfd52bfaa237855fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297017, "uuid": "771c744f-21f3-4311-9a45-a94db6bef71f", "value": "24576:eLRrWBV/skQ9A9bzoWl5Iit6jeThkB0tVSn52uzSXtS7vP:eL+sWPT+cSn52umXtSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644297017, "uuid": "a3b38833-aeda-4c0c-bcb7-fb8feb93e137", "value": 838144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644297017, "uuid": "3a0c5ab5-1dad-4050-af1c-e79c5e1bcbf4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297017, "uuid": "2973276e-b8d0-48e4-baf7-f3bf31392cc8", "value": "FacturacomercialdeenviodeDHL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ecceb08-88ea-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644330180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330180, "uuid": "3fa0862a-492f-433b-b320-a33bf21dfd30", "comment": "Malware payload (AgentTesla)", "value": "a720c0a3fd5fa5873fbd2932a4b67686", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330180, "uuid": "4f0b755b-becf-40ea-8a9b-73b40e7ef80f", "comment": "Malware payload (AgentTesla)", "value": "09eda982cc06f3b232ae2062a5cad0c304c4aa44826c408aa12d98393cbe8122", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330180, "uuid": "94ba6def-2afe-47e0-ae07-47e7d9440250", "comment": "Malware payload (AgentTesla)", "value": "973c6db6153469b703f8a62b772a78a61a9b3eb8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330180, "uuid": "43fbfb3e-b17d-4dc9-8aca-06fd755859ae", "comment": "Malware payload (AgentTesla)", "value": "26f70c2c620494b0a2bd44da61a537de111a938383e53cdd26eeaaa379a98ad73f43da727f8009674eb2a9fe71d10aa6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330180, "uuid": "691dddd9-3538-472d-9f9a-b70967404a2a", "value": "T131B40253FEC4CB79D5065B3058A3E66947B6BF66A931422F3344FFDE36B60418A023A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330180, "uuid": "0aaa82e5-3c7d-4ebc-a11c-ce5be9fdf505", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330180, "uuid": "62f74821-3ae7-4089-b9d8-919011e3354c", "value": "12288:AX2H6GV68gkcRVM8YEx3t4kRTPMmvvU75:S2mR/RVRBx9bRrMxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644330180, "uuid": "69fdebec-8585-4c92-a030-0da3012c9ab4", "value": 512330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644330180, "uuid": "efc92ab0-7a5c-409f-90ea-22a58e4dabec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330180, "uuid": "660d7d3c-3b35-42d6-bef8-7944ff783340", "value": "Scan docs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c203832-887c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644282878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282878, "uuid": "7739ec61-b29b-444f-937d-5cfd348ffb9e", "comment": "Malware payload", "value": "e3e49c273504ae8be9f4231164dd711a", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282878, "uuid": "5083ec74-f619-45c5-b098-9161766da2aa", "comment": "Malware payload", "value": "0a0148d9cc0ddb99f0734881a5851fa1f7c0c9a308f614b3a7255ad3b946f9e8", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282878, "uuid": "92f22084-0882-4f97-a50d-15dfb9924a25", "comment": "Malware payload", "value": "5fe68b7fd8fb05b22a8fdd2af297b6bde7f2a306", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282878, "uuid": "9677ee9c-9fc1-4d71-814e-d264d64d401b", "comment": "Malware payload", "value": "9dc705eab8b3f53eb2c02ae5165e42408b01eb283810b07b1b14dbebf11af1de1fc74fc619d609f1a9ab2eb0c344dcba", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282878, "uuid": "9c6b1ee7-b6e2-4eeb-a857-22bca2c8b15e", "value": "T1491412A4B117F482CB2C1072C7C6C972B1949E423E1B7DA7241B31BF6FF9A86465253B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282878, "uuid": "45d5a7c6-1184-4217-bd14-106af29bd6f0", "value": "3072:g0LkLXFcoxX/Minx7Hx1kygxxQqSpljSbxaqEbWbI+xkxZMHvyotj8kiN:kTFrxXvxzxWU3Sbxag8+uZtuTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644282878, "uuid": "03b94635-2fda-472b-b7f5-348bc1ac6b83", "value": 192136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644282878, "uuid": "f578aa17-5f78-4fd8-870f-e81eac4f3fe6", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282878, "uuid": "e4a3b463-bdae-4828-a480-ffff2430c091", "value": "Shipping documents and BL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8a0bcc-88ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644330099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330099, "uuid": "bfa53bc4-c019-4ec5-bb67-99a3887ebd4e", "comment": "Malware payload (Heodo)", "value": "816cfd0007ed4ae413dd545d2ba1aa7b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330099, "uuid": "79c783d1-8b64-48b4-a0a3-7e0e11fc1d50", "comment": "Malware payload (Heodo)", "value": "0a24808f59926bf36089022aacbd928e002d2e84f4bb6e052a5ba3dbec7b7da5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330099, "uuid": "631e6c01-70e6-4a30-9419-9c2aad7f1c88", "comment": "Malware payload (Heodo)", "value": "f9e372028fc23f29b70b334b53dfa9ea7ba640dd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330099, "uuid": "0fc0f12e-c37e-4aa7-ae94-e01098856946", "comment": "Malware payload (Heodo)", "value": "99bb058b2e7ad025ab1546a004e4d10f7d440f2ef6983646ec8608803cfbbe89952f21478ed529404360dbd52dbf7bad", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330099, "uuid": "dc84abd4-eca8-4123-a864-22a938d01777", "value": "T1DF848D06E652C03CFEFB04B8D496CA66ED5E3A24169D619F63413A6D32613CF123F52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330099, "uuid": "b21dace7-79f6-40e1-a2d9-d27f8f1065c3", "value": "79fb40281049052b3e354a6e444da473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330099, "uuid": "3d45877b-563f-4aca-a0c7-c52f2e7f4579", "value": "6144:O56dLjBFLyztOo9eYIjAmkB8lebi9JqGXdZ32mneM0laNUIbeURK46:YszuzN0jWB8f9JqQ2mnB0l4UMK46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644330099, "uuid": "adb208ab-38f9-4193-af39-96e09d63ae97", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644330099, "uuid": "5682e6c7-abce-45ce-a5fc-015855426ab6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330099, "uuid": "11028d4d-5e67-42c8-957a-31e7dce8136c", "value": "emotet_exe_e4_0a24808f59926bf36089022aacbd928e002d2e84f4bb6e052a5ba3dbec7b7da5_2022-02-08__142126.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1fd8d2d-88b5-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644307449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307449, "uuid": "8cb0aabd-cfba-4232-a74d-3b25311f5436", "comment": "Malware payload (Loki)", "value": "957a752544463f69d6527531cbc6e04f", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307449, "uuid": "22d6aef5-4fa9-40c7-9065-160320590ae2", "comment": "Malware payload (Loki)", "value": "0a2fac9fc8fd93fe68eacb0a52f09825f8124ce15a85de7f2ffaec558fad44d7", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307449, "uuid": "d9d3bece-b99c-434d-b1c0-8f4e56d4c47e", "comment": "Malware payload (Loki)", "value": "50404bf4e472044e4af9a5f38ae9e398c3c8c470", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307449, "uuid": "7b5addb7-6135-4f33-8a9a-1a005e793c4f", "comment": "Malware payload (Loki)", "value": "9bb4ac60c5291056b7c92cd6507644cd8cfe3aab891d90052188c9c5777596c09cff5ca9c6a9e97c192fc765a47ef164", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307449, "uuid": "29329642-006d-4b19-8bf7-e7afa09564d1", "value": "T17E14022124C01C46E2F51A37833D6257549CDF2EBAAB76862A37B12E07738295534FEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307449, "uuid": "08ef905f-9803-4afd-a887-c925298eb31d", "value": "3072:bqpwpf0wSE8TQHdv/FWHu5Dlb6xHN0FfdA7kR4BAUcm+EGctYF+xqGDLpzTE:ewd0wSERX2kDLfd2kR4BfcgGc+FK9DLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644307449, "uuid": "9c3e6727-f42b-4abb-b071-1a4615b40d0a", "value": 191880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644307449, "uuid": "f1de7ff4-639a-4545-ba0d-461e43d3d4c4", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307449, "uuid": "3ad85601-8972-41df-8f8c-59358738694f", "value": "PI-LUNACARE A.TUMERIC.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7546a6b0-8926-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1644355881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644355881, "uuid": "4087306a-dba3-48e2-8a54-ae0cede68214", "comment": "Malware payload (RaccoonStealer)", "value": "582a63b29a17c25c0c2e13927151b68e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644355881, "uuid": "8fe5512a-a81f-4a6b-b2ff-2fab02f8d5ae", "comment": "Malware payload (RaccoonStealer)", "value": "0a7682c0607e0fcb3580d28aec0e3439d6eae0cde1ab3359832046f7f33cdb0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644355881, "uuid": "a9be04bf-df96-44e4-a1de-bb230f479560", "comment": "Malware payload (RaccoonStealer)", "value": "7b228125e631c037ec24e4cc175e4774fe6c67cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644355881, "uuid": "ef2dcd23-e129-4b89-a6b8-2e308cf68153", "comment": "Malware payload (RaccoonStealer)", "value": "ca9d0581f3d7d76c74985f781310edb3af6b00f56f080f7ae495fc66dcedfa4e5a5b32ca9abf5d33c1fe098e9cf54fd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644355881, "uuid": "bf171634-7bff-4e96-8629-d4c0a7f509b4", "value": "T1955512A7B485C0B3E5A6193746A8FD28982FFD220B245DE337551C7B5BB01C08F3696B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644355881, "uuid": "5bfd960c-1c79-47b2-a7d3-15cf03446548", "value": "148d482ece6903c9871bc6044bd1df9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644355881, "uuid": "50cfcc12-2bac-4641-bff2-a25661d00c08", "value": "12288:HtDgjQoQgNuMmT4EXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:NDgX0/sqjnhMgeiCl7G0nehbGZpbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644355881, "uuid": "69bd5403-132b-4d33-afb1-815eeddf45b6", "value": 1366016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644355881, "uuid": "2eee5fb0-eb03-4130-b6c4-87bc06ecb15e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644355881, "uuid": "df5c605c-5eab-4990-8dd4-27ad658e6ab6", "value": "0A7682C0607E0FCB3580D28AEC0E3439D6EAE0CDE1AB3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24113294-8900-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644339423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339423, "uuid": "37bc85f3-ad7d-486b-8fcd-ca33a058989c", "comment": "Malware payload (Heodo)", "value": "d8a15eb4ab2f77cb61c607ef09b4302f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339423, "uuid": "51793bc5-ded9-4e4b-806c-e29550c6c000", "comment": "Malware payload (Heodo)", "value": "0aa7fe2d5cf3b791724aa12604817d7e7803aaddfbd475504d00e40310fefdf9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339423, "uuid": "9e9cd26b-02ad-44d4-9bf1-62e9977ca971", "comment": "Malware payload (Heodo)", "value": "a266b0c0af96a4df4c99b4eb0a8a19683787cafb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339423, "uuid": "3f4502fc-c3ee-458f-9f9a-dab3ad79f751", "comment": "Malware payload (Heodo)", "value": "27371e8a679991409979b6ef3eae69c047924c78c4dd398eef5237203e5540aa6e040a9068f6c23b0bbdc9b19d3d0951", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339423, "uuid": "bc2cc82f-33ec-48a5-b085-3c01bf5f27d1", "value": "T12CC35A55F685EA1ADE0812350DDFCBF9333ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339423, "uuid": "83bd6bf6-791c-4416-8d18-6bc466c1ad5b", "value": "3072:LYcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBe:ccKoSsxzNDZLDZjlbR868O8KlVH37ke6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644339423, "uuid": "cdf84538-8972-44da-a693-fd5e8800c510", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644339423, "uuid": "3dd6aab6-230e-478f-9c77-b12c29866525", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339423, "uuid": "bb13edc2-f5a9-4232-bcf8-4eeaf0135c63", "value": "tmp24k_66ph", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba0c627-88d4-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644320619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320619, "uuid": "722634db-0357-4098-9d4e-b6c82218ba13", "comment": "Malware payload (Formbook)", "value": "b61a1288e0d6c903a4962e5c037dc653", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320619, "uuid": "c4db759e-60d0-496e-99f6-76f8f8a2c189", "comment": "Malware payload (Formbook)", "value": "0ab19b205a91984c1143c4583130c911131d1606a2f7e38ea91c9c1860cbd14b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320619, "uuid": "d4e275aa-9daf-4961-a591-cc6314cc0bd5", "comment": "Malware payload (Formbook)", "value": "fbf23ba256d10dba3afc76e0ae4a96a02ababa57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320619, "uuid": "41eb0098-576e-428f-a5e7-18eaba939237", "comment": "Malware payload (Formbook)", "value": "8fc9a81cfe67488e9aa3d4d6318e15995364233fa7674109aeecb2c0ec1ec25d42b642e6e0c35ceb3375a274d3d4cb2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320619, "uuid": "3ae89c89-89eb-47cb-bb52-d3eacb2bf3d6", "value": "T16CB47B3F49BF213AC6BCCB7199C4CE1FB426D5563977691D2A9222D904232F275C222F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320619, "uuid": "e72dbae7-e4cc-42c4-ab0d-a3bc4c9853fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320619, "uuid": "38d8ed86-1760-42fb-83ca-a741915f214a", "value": "12288:Ul+5Jjthi7SEVvY/Ige5AJ3LlF76G9vU:UlOtEYQ4J6eU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644320619, "uuid": "4c4a113e-d2f8-4708-85f2-ec88ebdada69", "value": 522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644320619, "uuid": "1c84e3a3-5a4e-4b6e-b215-cde2ed3c2b8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320619, "uuid": "88b018c3-623f-4a0c-823e-4565782d9e5c", "value": "update status of order 07G050.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0557ac70-88f5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644334647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334647, "uuid": "7261cc9b-7ad1-4670-ae3f-d7c69e12c92b", "comment": "Malware payload (Heodo)", "value": "39ac7ddd6b299ac9cd563e817970da70", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334647, "uuid": "a4af68ed-5385-4cc6-b9a1-78ccf0cc78c5", "comment": "Malware payload (Heodo)", "value": "0ad7d5db0ae2d6b2a4bf2e4baae2d3eefb4697c5e61bf14fb8284d5391921410", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334647, "uuid": "76c61b69-53ba-4525-85a4-042b18549d98", "comment": "Malware payload (Heodo)", "value": "28e8b0a15e2d8014eef277d01320ddfb30e7e5b1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334647, "uuid": "546cff00-c6b1-40ce-9ec1-03d4cc39a1d3", "comment": "Malware payload (Heodo)", "value": "e19f59c10951581191e32b36e6fa7b45cde75ba350f2fd121c10ba33d5973d928aa3c79b9c6584793b7a9dbbb2d58093", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334647, "uuid": "706ca4ee-f589-48e2-b2bb-d86e58d4146d", "value": "T1FDD38D6AB648CE0BD94953314EE7CBF67336BC819F5297473295B72E1C3A580CA07B06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334647, "uuid": "e2264a45-2e9c-4e1b-998b-0874c9d9e435", "value": "3072:JcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dg5a3B:JcKoSsxzNDZLDZjlbR868O8KlVH3ske2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644334647, "uuid": "5dbb678c-a163-410d-ad26-0783ef8dc101", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644334647, "uuid": "64243eae-9f07-4ccb-b305-944cf139ff5f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334647, "uuid": "8037a698-0263-4234-a847-9466ea52c9a2", "value": "OPEN ACCESS EBOOKS.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d7264ca-88b2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644305938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644305938, "uuid": "49048324-c016-4975-a5b8-a232501e4273", "comment": "Malware payload (Heodo)", "value": "8fa28c2ea579947ce177a4726cdc7a82", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644305938, "uuid": "d59d0150-00cd-46b6-8f53-2a6efb410077", "comment": "Malware payload (Heodo)", "value": "0ad96801dc02c519b7a63c8052ba1520781c1679c0a09a672500a6e3208810c8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644305938, "uuid": "e725ae1f-b9b5-4bc4-b2c3-68c75ea4e7a0", "comment": "Malware payload (Heodo)", "value": "e82e9c9a0db32c85dc8c54aaf2cc9a45eed71b65", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644305938, "uuid": "f768eef6-6fe0-4a75-9ead-8ebbed4f750b", "comment": "Malware payload (Heodo)", "value": "f20d5a624ddb9f1f30efb45b3985c4d6a4e13438b150b2ef6462b31bf4add8501c54999b0d2041cf8567dc1b3103343a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644305938, "uuid": "20ed542d-befc-42b3-a4c5-bf4a10631181", "value": "T14B93499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644305938, "uuid": "b569b1dd-89fd-4a60-8ac3-1e92d45a4ad5", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644305938, "uuid": "a4bc293f-4a66-478f-8eb9-635ef31d87f6", "value": 96583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644305938, "uuid": "db9cdbf3-d0b3-44d1-a9a2-4c64e061269f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644305938, "uuid": "0f4e81a4-d244-40ee-8599-c7293cbd3da3", "value": "tmp_vssgjeg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3501af8-8913-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644347851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347851, "uuid": "ac736b6e-2afe-4c03-8bbc-5554a3fb8b21", "comment": "Malware payload (Heodo)", "value": "4ff8fdbdeaf0f0ed5e3ba7219ad3f811", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347851, "uuid": "cd743a89-314d-4ce2-9e58-9b490b4b667e", "comment": "Malware payload (Heodo)", "value": "0af3d4cdf842ee68c64136a90764758b1258b8162767f70b2a4fe31f1176edb6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347851, "uuid": "e87723a2-da81-4778-83dd-e65dfcc2b248", "comment": "Malware payload (Heodo)", "value": "0bed2512ad0792f41fc8dc95be88488a65802309", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347851, "uuid": "cbc1088a-fdd4-4dc2-bdc1-336962194274", "comment": "Malware payload (Heodo)", "value": "94be0e9fad762d332c69118b0d3b1592cd4c42810d028a77cec74756d9740975dedeaa647817ba2a891083a9f8a102f1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347851, "uuid": "53185f83-c9fc-41f4-aba8-d0044705d5e0", "value": "T1B5C35A55F685EA1ADE0823350DDFC7F9733ABC828E9683473289B32F7D76550CA12606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347851, "uuid": "cb1f019e-ba11-47e6-ac0c-3086641ee7b1", "value": "3072:gucKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBR:pcKoSsxzNDZLDZjlbR868O8KlVH37keV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644347851, "uuid": "5185be1a-7b74-4be1-a8f7-d4b8a8862476", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644347851, "uuid": "61bddacf-589a-49fb-8ef1-dafb5f117c6c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347851, "uuid": "a2846613-0825-4a95-8364-59de25f0ae0f", "value": "tmprs_pdss5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e957544-889e-11ec-9275-42010a9c0029", "comment": "Malware payload (LimeRAT)", "timestamp": 1644297485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297485, "uuid": "aad2ad67-49af-4856-ad65-3076b658624e", "comment": "Malware payload (LimeRAT)", "value": "b2aa70a4933a9a8ca974fdf9e762e084", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297485, "uuid": "5615dee2-7217-47f7-a26c-61fbe666f97f", "comment": "Malware payload (LimeRAT)", "value": "0b1034f063627ffa381f0fa2351e2656948870d197c6a06897e9d5827c5d6b24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297485, "uuid": "187f960b-74db-4fb8-a0ed-be444b40b980", "comment": "Malware payload (LimeRAT)", "value": "4237396c3296f79866ced8eb3096803c322ba14b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297485, "uuid": "7387b5ab-1772-4d83-9ffe-f8b86f700d10", "comment": "Malware payload (LimeRAT)", "value": "471995f9897145fda0697a6b99792770107249996d1e9c84f71a4b900524237e0a126dc677daa7decfbf16a9fcb5b642", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297485, "uuid": "5817ab87-088e-4147-9c0d-c121fc7ee979", "value": "T1E264CFB964328956DEBFCA796B31EA7D4F25A376E307363400C4B71D04C0BA98B95633", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297485, "uuid": "fd36087f-6d82-4dc1-91d8-0a3b0c1986d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297485, "uuid": "839a15f2-4e91-49cb-82a2-0b262b555aef", "value": "6144:+K+SjAdHfa4/beRitPuPa+kIpihu8Sk2wUTxoAFr2Rsmi:l+SjApVQauZihuDeLar2R/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644297485, "uuid": "8032783c-a93c-443c-a695-72f5de7c1fa4", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644297485, "uuid": "0e7f8f31-71dd-447f-9910-4bfbf751eb33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297485, "uuid": "2bea831b-b4a3-44c3-8c3a-fc8b45011eb4", "value": "wUYia5ZSvQcHRWY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42a33f1-88ba-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644309600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644309600, "uuid": "6950bc1e-166e-4309-97b3-ac67d77108c7", "comment": "Malware payload (Gafgyt)", "value": "4a1a3c0f396b86770898bd9d7ab1b577", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644309600, "uuid": "36a1ef5f-aaa0-4f96-b518-f2513839d537", "comment": "Malware payload (Gafgyt)", "value": "0b8303970746269d469ee35c525a71b1b7ba2c9c609defe41082be86f1b8e58e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644309600, "uuid": "c831287e-2f3e-47c5-b77c-552db5c86438", "comment": "Malware payload (Gafgyt)", "value": "db65d011e0a6be304fbb6f45107fbb6af19a62a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644309600, "uuid": "7acacee9-43e7-449f-8e9f-06a3d12e71cf", "comment": "Malware payload (Gafgyt)", "value": "7198de780b156280cf270591da50c8ba360bcdb5ee449b32cd985801bdeed540202dd8fdbea617312e85b65a1e6bacc9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644309600, "uuid": "e8dfd481-c931-4637-8e0f-a3a1829ad28d", "value": "T1DCA32843A9628FB3C046AAB526AB5D740B53AD911F5F1A95743CB6F0033F5CEB40EB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644309600, "uuid": "42f08a4b-5627-44db-ab4b-fd3d3c6bc0e6", "value": "3072:tY4VQ6XXgjNZpCzouIyXmH4pbbqEnK6NS:tY4u1JSzoximH4pbbqEnK6NS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644309600, "uuid": "a59b0257-8e89-4dfb-b42a-06c8a2e2501b", "value": 105637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644309600, "uuid": "53960471-0454-461a-ad83-6e84bb493d31", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644309600, "uuid": "e509497b-a8c4-4d05-b66a-6ee3a6c046d2", "value": "4a1a3c0f396b86770898bd9d7ab1b577", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11866442-8932-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644360867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644360867, "uuid": "87942dc3-81c5-4ac4-8aef-fdb396d5c5e0", "comment": "Malware payload", "value": "8d35331512fd33566cabb211775ce87c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644360867, "uuid": "74e74e3a-c48c-4a35-bd4e-eb2aad78413b", "comment": "Malware payload", "value": "0ba92a2d463d829986917bd3799bb064488a1f162e024eaf78510fda2e6eed6a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644360867, "uuid": "77ff7d81-167c-4499-9222-6dfb657b172e", "comment": "Malware payload", "value": "fd429bdb7c0fcf8abf9910fd6bd654e070117687", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644360867, "uuid": "20733f54-4ace-4327-b7fb-b1f65c33f3c8", "comment": "Malware payload", "value": "032038cc8a55a445cd4c317c0a7420e76033eb1045d1e68820907b479db7f92a31ad2836c8f7bcfa573e7760ed5ef517", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644360867, "uuid": "6416315d-551b-4d71-8a0c-c887a9d39acc", "value": "T12CC35A55F685EA1ADA0823350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644360867, "uuid": "aba04439-c152-4b93-b3df-c3dd92ebf36e", "value": "3072:ZUcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBw:WcKoSsxzNDZLDZjlbR868O8KlVH37keo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644360867, "uuid": "a35ff652-25f9-4eb9-9c02-1ec7514e3de1", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644360867, "uuid": "8e5d5d58-1712-4562-8324-9c9f9216d6d3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644360867, "uuid": "950b12a4-525c-4771-b382-c637d0d6580e", "value": "tmpg1i_189c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a5ffbdc-88ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644339031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339031, "uuid": "aee3caa9-7745-4908-a477-ba6d1074b85b", "comment": "Malware payload (Heodo)", "value": "1a7b1c621ac63f0d42fb405c140c0752", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339031, "uuid": "41ff5654-cc1e-4d5a-9506-1d0ad16add1b", "comment": "Malware payload (Heodo)", "value": "0bb42aa30a4fa0e54ed671f90598b52e5231c182110339ff9e1effab099a78f0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339031, "uuid": "05df412c-d67b-4739-aad7-183d680d48c7", "comment": "Malware payload (Heodo)", "value": "6ad093a00e2a2c954326cb1ef679e1a534b0259a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339031, "uuid": "c42c2daa-3dd4-459d-a9a1-8e7b2e55c939", "comment": "Malware payload (Heodo)", "value": "52110eb08549639d284d72a15e184d95d2c81c85ac356a18cc4d835d3a360d3a4b7cee68698dadc7b72c6a518732ebc5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339031, "uuid": "0beaaf5e-228b-4fe4-987b-9ff71e9196d4", "value": "T109C35A55F685EA1ADE0812350DDFCBF9333ABC828E9683473299B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339031, "uuid": "77e03671-661e-403c-9b14-107b1bf1e343", "value": "3072:uecKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBA:bcKoSsxzNDZLDZjlbR868O8KlVH37keE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644339031, "uuid": "96a4cbfa-4199-4266-a2c4-6865bb9710f7", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644339031, "uuid": "56903a33-0356-4ed6-85a7-a2127848a1fa", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339031, "uuid": "0eca531c-8ac8-4827-8bfe-ef8188183a3a", "value": "tmpaxcy1_ng", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "246745e3-8872-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644278436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644278436, "uuid": "0861724f-8b75-49da-adbd-1ab44a1840c7", "comment": "Malware payload (Heodo)", "value": "a98de87ad8fe08843ac22d9d6abde666", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644278436, "uuid": "de21a673-1cfa-47c3-b31f-69e7edac8f27", "comment": "Malware payload (Heodo)", "value": "0bb7ae3ce466542f3f4f2f87322f43763bdf9d5d07535c8813d700e6b9956eb0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644278436, "uuid": "b17f2e27-784c-45e1-968d-f379f2340a35", "comment": "Malware payload (Heodo)", "value": "c0eb6401f1182dc8a0f16d6b9ef1976d1ff57ee6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644278436, "uuid": "52699427-648e-4064-bd5b-39c828a596fe", "comment": "Malware payload (Heodo)", "value": "941c5ebb78abc3eca4fc5859a983d794662246674d7caa22e32f706bad885d9e93d3591343a9f1f78d7799a0a9ca637d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644278436, "uuid": "70f6377a-f520-4ee1-ba8e-8ccab1668363", "value": "T157D429AB3A8FA1BDF17B017A6350FB44E4D27C1A9FBD25D70A86358893F2D054F18A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644278436, "uuid": "46175124-0e4a-4201-8152-23939d3535a6", "value": "bf1ebe22ec6f51f906ec295a3a5c6d92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644278436, "uuid": "20ee8ceb-ae30-4175-acbe-22b9d42ef592", "value": "6144:x42k6LwFPw91EDbkUE39P7pyADYzqlEDFmZ4s3wADfcvIpxUIVZFoEXlbeZhp4ga:x409qDb109PdyOYzq3d3fVbeFTi40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644278436, "uuid": "6135e37d-3c00-4928-b1eb-183be41d8e5e", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644278436, "uuid": "5d7f8a20-96fc-4014-b79f-d1bd1ffdddb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644278436, "uuid": "534006e6-e0e0-4a02-9315-11bc142b0f89", "value": "emotet_exe_e4_0bb7ae3ce466542f3f4f2f87322f43763bdf9d5d07535c8813d700e6b9956eb0_2022-02-08__000030.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3fc5ca-8903-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644340917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340917, "uuid": "e2fc0209-3939-4bb1-b464-4295afb0232e", "comment": "Malware payload (Heodo)", "value": "0c7321061c9d1f71d8e514f5090c8885", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340917, "uuid": "f2c60b40-8740-4bd4-a471-b56d25cb3fd7", "comment": "Malware payload (Heodo)", "value": "0bce12050355787d9b564fe1946c46fa273c643bd980cdc17b3f67a7a8b1b29f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340917, "uuid": "6c43f6b8-6691-4a12-b6c0-0a169a27351f", "comment": "Malware payload (Heodo)", "value": "497995f286448bf834aaacd75b2259327bdbb980", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340917, "uuid": "17c27087-90bf-4979-aeaf-2f718f8a3559", "comment": "Malware payload (Heodo)", "value": "1121f23bcae5979738311c793729569f30f82c89394f9034568fcdbd2de575c8eaae78458ed151e90e279e1a4f825be6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340917, "uuid": "ffa5d2f2-ebe2-48a6-ac4f-92b35700d3e1", "value": "T1B9C35A55F685EA1ADE0822350DDFC7F9333ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340917, "uuid": "0643348d-ce23-45f5-ba81-134bd383d1b9", "value": "3072:91cKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBn:XcKoSsxzNDZLDZjlbR868O8KlVH37keT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644340917, "uuid": "a65e3d63-cb5e-48f7-b476-7e9f4d046888", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644340917, "uuid": "4af04caa-91ca-4afa-9054-ddb612575b22", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340917, "uuid": "742536d3-d826-4cb1-a463-394bf0585be0", "value": "tmpfyu76ppu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e562cd13-8878-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644281336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281336, "uuid": "eddc124c-504a-471c-9657-be4d64442187", "comment": "Malware payload (Heodo)", "value": "d7d88c5e7baa464538d2db93e8ea97f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281336, "uuid": "c42ceac0-610d-40fb-ba6e-f5529290666a", "comment": "Malware payload (Heodo)", "value": "0be8de3d3e7d2ad43ed67d469c99716a6cceb7692a799adb79df93b643dd8d03", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281336, "uuid": "bd70694e-3fc4-4df2-8910-7c157b971da7", "comment": "Malware payload (Heodo)", "value": "754859e78f83825ad3175a06e6a3b8d79b5e34b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281336, "uuid": "bac4e351-1b0b-4901-8bbb-29e2edf96062", "comment": "Malware payload (Heodo)", "value": "3af74c3561ffd807955bff1f1f84c7f7a0d6df7319cfad08ec6e23c428755c24f199680ca3b92adc311996550585ac16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644281336, "uuid": "aa2cfc66-b487-4cfb-9572-38ca26d9ccf8", "value": "T1ADD429AB3A8FA1BDF17B017A6350FB44E4D27C1A9FBD25D70A86358893F2D054F18A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644281336, "uuid": "d991e9fa-c9aa-40e0-9274-6b317e0aa46e", "value": "bf1ebe22ec6f51f906ec295a3a5c6d92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644281336, "uuid": "9c3b3d54-5bf7-4f74-9831-1c9f49db531c", "value": "6144:x42k6LwFPw91EDbkUE39P7pyADYzqlEDFmZ4s3wADqcvIpxUIVZFoEXlbeZhp4ga:x409qDb109PdyOYzq343fVbeFTi40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644281336, "uuid": "a1ff7289-43a0-42db-98a8-372b7e6a6690", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644281336, "uuid": "f6a91907-3333-414e-8d03-1e8c9b649c1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644281336, "uuid": "cfeaba13-e37a-4b7e-927f-3fc267b61bc9", "value": "d7d88c5e7baa464538d2db93e8ea97f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed95a583-8896-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644294235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294235, "uuid": "28353754-ca19-4289-96d8-b95121b315f6", "comment": "Malware payload (Heodo)", "value": "3735c77fc909a9e60e8102a7ce2c87c6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294235, "uuid": "f10edd3a-5215-485f-b6a1-0126e9a49547", "comment": "Malware payload (Heodo)", "value": "0c210b553756b206fd82c353900fe48c06e55330dfa47f883b98e5c5c7f9c800", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294235, "uuid": "f21e2336-aa18-4d11-8c0a-df7812b088ef", "comment": "Malware payload (Heodo)", "value": "37c0f04f38d906005acefc914560b72735171af9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294235, "uuid": "2005b749-a6a4-465d-ab4d-85cfcb1cd05e", "comment": "Malware payload (Heodo)", "value": "a0b20086c8658de4ba7e6ddf1fb132898da00f4e0d85e4e7b651b1c3d57da7e68c9f2f284a8cbcc8e715a2d7fb1c9481", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294235, "uuid": "a1822905-ef17-4751-9697-3dcca3b7d889", "value": "T1DAD38D6EBA48CA0BD94913314EE7CBF67336BC819F5297473295B72E1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294235, "uuid": "0aa33926-319e-4066-b348-3afda5eaa3f3", "value": "3072:kcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3v:kcKoSsxzNDZLDZjlbR868O8KlVH3skeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644294235, "uuid": "ac88b89c-0741-4f1b-a07c-f9f689d498ea", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644294235, "uuid": "84db3893-9f5a-4055-9946-a67042baf9d2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294235, "uuid": "ef5a68e4-f725-4ccd-aea8-b59a7ba78ecb", "value": "tmpnhxwjxlx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f82d718-88d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644321565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321565, "uuid": "0adb0ccd-307c-40f1-ad20-f24bc0412ccb", "comment": "Malware payload (Heodo)", "value": "9194c955b7e46c1dd5800b2709f4c338", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321565, "uuid": "e74dc336-8d8f-477b-8994-fe5ebfea4cc4", "comment": "Malware payload (Heodo)", "value": "0c2be7657ec380908ced2f6ed54e40a4ba9be36e27b51dcbdca7600e5252b9a2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321565, "uuid": "4fa6fff6-68c2-430e-a5e7-2488f2aad14a", "comment": "Malware payload (Heodo)", "value": "f8016292960cdf5e54a5c9da485f17f21717d21f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321565, "uuid": "232057fd-5229-47e3-acea-421296ff002e", "comment": "Malware payload (Heodo)", "value": "0c80c9dab2a6722568cdce498a79b06c92324d06cf73d19246e0f3de792dc087fbe99e11b224662204618d5a95314c56", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644321565, "uuid": "83e8b8d8-11f0-4d0a-9072-88fbf877e419", "value": "T19AC36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644321565, "uuid": "48334bc5-3b3a-406b-9bb0-aa68599df655", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644321565, "uuid": "f85f1464-684e-40aa-b8d8-a36e482b650c", "value": 128312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644321565, "uuid": "8927d5b7-1533-4062-8932-cbeaf63d537d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644321565, "uuid": "58d9eeb5-e0d9-4f86-b6ba-1eef7bdcb9f4", "value": "tmp_qg4eiiv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dcb5bb4-88ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644330018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330018, "uuid": "5bc9237b-f12a-4367-8b1e-7762d79c7d49", "comment": "Malware payload (Heodo)", "value": "42ab64f91363470010aed6fc827167d0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330018, "uuid": "0d7c9f8e-55f3-4028-9da5-4e806bfb3956", "comment": "Malware payload (Heodo)", "value": "0c64126ecd5c0515c12bb90400f34f6134161b6bae7d6c09b4ccc5fd80ff683e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330018, "uuid": "d13d1e9d-c649-4304-96c4-0fce5c00ea7e", "comment": "Malware payload (Heodo)", "value": "0e4487d97683bc93c6a2ac1c87268f8c1d5454f0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330018, "uuid": "43775790-dd71-4a3a-b7b6-2e3c269a305a", "comment": "Malware payload (Heodo)", "value": "6e3af2dd252868f5062bf7df29514f21705451ecf20f948d696c01a0b9bb89a878900db945bf36ad8c052ae97167b8ca", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330018, "uuid": "7408aa5c-4638-46fb-89cd-e688e037d762", "value": "T10EC35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473299B32F7C76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330018, "uuid": "59dc5ead-e601-4911-825b-09da2d9695c3", "value": "3072:98cKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgcBi:ucKoSsxzNDZLDZjlbR868O8KlVH37ke9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644330018, "uuid": "0e75fbe6-2dd9-4bed-ae89-de831fd5286a", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644330018, "uuid": "5c202995-217d-4e2e-8c6e-f2f9073e53b8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330018, "uuid": "f0d90448-4f02-4370-a120-abb71cac8d9b", "value": "tmpv49_3zd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e743b4d-8912-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644347172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347172, "uuid": "0bf8dd90-e6ad-4140-97fb-30f784d511d1", "comment": "Malware payload (Heodo)", "value": "883fc053a4646d88ce45fb20cad0a1c3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347172, "uuid": "fa705be3-baf9-4b9a-aa6e-e67d93481fd6", "comment": "Malware payload (Heodo)", "value": "0c6f11798bad53bfdc776f01cc89586ab5488176bc0aeca6e78790fe0b35883f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347172, "uuid": "b78848ef-ec5f-4380-8ba6-c1fbd4daf47c", "comment": "Malware payload (Heodo)", "value": "90daf972d576ff57125fef46a58a70f25682cbbb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347172, "uuid": "28960ac9-4c0b-455d-80dc-2668ffeef1b1", "comment": "Malware payload (Heodo)", "value": "4a07734bcb8f4685ec7ea86bd5c1c3a6c450b1d3784dc59928dcf0c101eb5a7edb2c30f2ff4964ca80a10c7d57dec72d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347172, "uuid": "6c84b448-d9ec-4bd7-a0f0-b3d5375a0fe2", "value": "T130748C41E952C03CFEFB00B9D4D6C62AAD1E2E211B9D569F6244366D36603CF163F62E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347172, "uuid": "0f0b1231-0fda-4df4-a5b2-db1280c66a79", "value": "79fb40281049052b3e354a6e444da473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347172, "uuid": "b17d0386-46f0-4b66-b22b-81abee1c30da", "value": "6144:YFF10hIGpvseY+wBuBqtrgummwYT4ahREWkOieUR6:yKIG5hEnmGcKS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644347172, "uuid": "df324752-8d67-413e-afad-aa30474a8d22", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644347172, "uuid": "07b78db2-b0d6-4770-861b-8a9eb5a88871", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347172, "uuid": "e5604357-5857-4fde-b322-bf451a65be99", "value": "emotet_exe_e5_0c6f11798bad53bfdc776f01cc89586ab5488176bc0aeca6e78790fe0b35883f_2022-02-08__190558.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c9057c3-8905-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644341558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341558, "uuid": "fa785e70-c92d-466e-83fc-5571fa6adffe", "comment": "Malware payload", "value": "00233d9e3ad48e79431cbded8aeeefcd", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341558, "uuid": "b21deba8-baaf-41eb-8819-35f5f39069cf", "comment": "Malware payload", "value": "0c702505fae2993bfe6d831aa9289ce6c73ccb81a9fa30360e7bff5c55a84857", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341558, "uuid": "c59711eb-7888-4201-b400-87e948b799fc", "comment": "Malware payload", "value": "8d6003bf4db683b9bc860680c76bdb0b960d43bb", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341558, "uuid": "29769fde-72e2-4efc-b03f-eaa123d578ae", "comment": "Malware payload", "value": "17c40c88b07d0f37ab736b8275d4a956b579c804df8bf697deaf329b9c0fc611be97e2d87aad7ca7f04ec2fa24e9f3b5", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341558, "uuid": "cf6a0b17-fd01-47d8-bab4-993711488a60", "value": "T125141238B958838ACD6CD53554793FB98E6ECC43EE247E5929C83F7588B3842C2B3416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341558, "uuid": "de6ef34d-8df3-4ef6-8499-6137494c90f8", "value": "3072:+FjsK0BPVucNy0o771RS73LMZzC2Or8SNJl49MX+bwCswD3/QnbfJepF9R+5H:S90BNzNy0o7ZJCt4SpoyGfUnbBIF9A5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644341558, "uuid": "b53353aa-4cf5-474c-9574-127206bf1fed", "value": 191848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644341558, "uuid": "25acf569-7af3-471e-870c-decd14466f08", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341558, "uuid": "67f929c2-1e2a-412d-b6ce-9098097d534c", "value": "BANK DETAILS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bdb4c75-88aa-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644302554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302554, "uuid": "5fc84a67-23f9-462f-a5ba-10f148acd1d9", "comment": "Malware payload (Heodo)", "value": "42a2af4ccd5b59fa4560631b63c15fa8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302554, "uuid": "60d53927-4d7d-44f6-96c7-00933b86dfd4", "comment": "Malware payload (Heodo)", "value": "0c9941fc6aeedf40c135ef39273e85d9430d2ffcb27f19340b307986fd94654c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302554, "uuid": "68fa97ba-08b7-4a81-8689-2fd2ed97f342", "comment": "Malware payload (Heodo)", "value": "910af0e0c1c34f3598a23b8bbc1a6a8b2c2768a2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302554, "uuid": "dbf3d425-631e-496d-b1f6-b00d01bd10f4", "comment": "Malware payload (Heodo)", "value": "a00f45c18fe88d9713a178a9bc164d04a19cb2bf7e520051f1e27e2248ead5acc52c947d0aea100688af0a594161b1bc", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302554, "uuid": "82613c1f-4b53-44de-b397-b6b3fc876d1c", "value": "T1DB93F16D7E2C3D07E5D7E238CF3CD96092145DE076A2FCBA64A07FA90139493C166A6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302554, "uuid": "5d3de75c-6d20-4f92-a10e-3f82101726bb", "value": "1536:zZRkPT3cOTmKQBz3sQSKa3Xm1WBXz7yL64i+kkfa+3gtfvjHtoxzg5bjIF6O:zvk7MO2B9a3Xm4nC5X5gxvhoxzMIgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644302554, "uuid": "d5aaeb3c-459c-44da-8bbd-3778503eca03", "value": 94223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644302554, "uuid": "5b10aeee-5484-4e1c-8a58-1b8ba80ea5a0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302554, "uuid": "a7d91cea-075e-452e-b918-756853860797", "value": "tmpv03v2sxo", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d776d34-892f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644359599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644359599, "uuid": "2d6202bc-10af-4279-8511-b859943eb44a", "comment": "Malware payload", "value": "f6f976e4e929c1e079ef14b247074103", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644359599, "uuid": "014fae81-a604-4a07-82d8-bbfb6f6f2db3", "comment": "Malware payload", "value": "0cc82f7ee5c1634289bc862a73a66c228c93f67e8426b1b4a399dca6b9b4ab65", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644359599, "uuid": "af117b06-9f11-4e4c-94d9-b6f34a5e4464", "comment": "Malware payload", "value": "a2a9e9b7028c6113121c6bb6633fb8da447f5890", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644359599, "uuid": "a22e9e6e-a9a6-4e90-b2e7-74292ca7e094", "comment": "Malware payload", "value": "8f09c4e906c03850855ad1b606e7e675385ee500b98d45017a23a05e758b9a417920678c8f43300646e09e59570e2449", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644359599, "uuid": "6e9d5a1d-14d9-4c4e-827e-a96bc3711678", "value": "T12CC35A55F685EA1ADA0823350DDFC7F9733ABC828E9683473289B31F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644359599, "uuid": "f5a4942c-7cce-4a71-aa3a-30bbfed63962", "value": "3072:SDcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBb:ycKoSsxzNDZLDZjlbR868O8KlVH37kez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644359599, "uuid": "e2470085-db2b-44b2-9b96-f91fb49a93a7", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644359599, "uuid": "21fd5541-c0d8-4f0d-9650-7459f7058a12", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644359599, "uuid": "90674b5a-582d-443b-ab86-5e4d98b01989", "value": "tmpj4v7c2a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39af7407-8914-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644348050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348050, "uuid": "1c71afc0-3038-40ca-932e-ace473d4ca44", "comment": "Malware payload (Heodo)", "value": "a7fae3f13ae90b067c66a04ba7d6a4fa", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348050, "uuid": "4471dbab-0499-443d-b337-1b81e69c8b83", "comment": "Malware payload (Heodo)", "value": "0cd9bd0ce9532e294e5577ef50e015d43a0f1e1e1b2e3472b9ebef0b497e0139", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348050, "uuid": "89f349a7-5bf9-4c9a-bc76-97c332202a3c", "comment": "Malware payload (Heodo)", "value": "e8eecf72d5fc861d1651ea41e7c1c91f679b9393", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348050, "uuid": "935af016-6143-4d26-b4e3-3d28a981b89f", "comment": "Malware payload (Heodo)", "value": "58b3d98edb679f353fd7c636e13b800ac4eb8e0f7eb60be61f0220e229cc2d1c7c325aecf659ad1394e6ce2ccbbf0f5b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644348050, "uuid": "c4d9b445-9ed0-403e-b2a2-9339498a8169", "value": "T1F6C35A55F685EA1ADA0823350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644348050, "uuid": "a07a01f4-a881-4c95-b072-2842a862a00c", "value": "3072:qucKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBW:ncKoSsxzNDZLDZjlbR868O8KlVH37key", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644348050, "uuid": "4c23c8cf-2d3e-4989-951b-b8bf5d6f0295", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644348050, "uuid": "6f2c3e21-e83a-45a7-8c7c-a4b144b44c0d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644348050, "uuid": "e5c8b487-56b6-4237-a3c6-e197ab87be8c", "value": "tmp_bhdxmq2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30fbb7c9-88a7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644301220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301220, "uuid": "c1691f37-1333-4ce3-ac79-e51fbe43009a", "comment": "Malware payload (Heodo)", "value": "e60444af47381a0f2e1f3380a164fe2b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301220, "uuid": "e5ab4932-838f-4981-b569-3452b32a1c3d", "comment": "Malware payload (Heodo)", "value": "0d02389a32893bc73f5c28e3b9fe5d8a49bc9bf0e4e13fb717963b1db0bfffff", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301220, "uuid": "7dd38ba9-7db7-44dd-83c6-421c60d2d386", "comment": "Malware payload (Heodo)", "value": "5eda545d4c8c082ecd03648a5c8a0c6573fb3996", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301220, "uuid": "492d8fb3-3429-4a60-b2fe-69fd61d1d53a", "comment": "Malware payload (Heodo)", "value": "e7888121f1bb1213292b8c105db370a74a3c69ab160f4ce5294bf9da36693d0ded4cd701771f1b510c13fe757a53e384", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644301220, "uuid": "7aa0e232-5601-4b5b-be52-c9c3da7cfa8b", "value": "T1C893E15D3E1C2D07E1DBF239DE39E95092541DF166A3B4B9A1B13FA9103D083C266E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644301220, "uuid": "a17ad1aa-e2c6-46c0-8455-fa845dd18cca", "value": "1536:zZRkPTope8zqPAyOw/1aWSKa3Xm1WBXz7yL64i+kkfa+3gtfvjHtoxzg5bjIFn3K:zvk7oDuPSSa3Xm4nC5X5gxvhoxzMIBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644301220, "uuid": "c12316bd-12d1-45c2-91f1-d60315d32d84", "value": 94222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644301220, "uuid": "d6fec8bf-4ff2-4d6e-b78c-fb0e6f0c079c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644301220, "uuid": "4d20e2de-5a03-411e-b7e4-e56450d654bd", "value": "tmpgz3qrmuo", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d615c01a-88c9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644316100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644316100, "uuid": "fe410e31-1c3c-4e3d-a4f5-2403ad02d5f4", "comment": "Malware payload (Heodo)", "value": "cce42fb42fcacac94f97a17352557952", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644316100, "uuid": "aa846549-f099-4bde-9611-1cb68b749813", "comment": "Malware payload (Heodo)", "value": "0d129af45519c50b3152d392b8b9ac6e1c25b8d7d2baf16ca32a4a5d3663f4e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644316100, "uuid": "d03cce53-c793-42e0-94f7-d665516da537", "comment": "Malware payload (Heodo)", "value": "e36938d5658ec5e8bbc8a2364872abaa442378f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644316100, "uuid": "d522064e-9930-42f1-971b-f34f2f33c038", "comment": "Malware payload (Heodo)", "value": "71b55cb4485e9d857eabe4c2d572ef74a62cbb8a66126ed104f02d2d523e4a544edfc96ed762651fdbf93805d28b47d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644316100, "uuid": "8b57b8d9-8393-4b88-9be7-42417d328e43", "value": "T1E0F4C0006582907AE4F930B842667BF1E93D1CB0372511D39BD069FEA6E41F1B6B376B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644316100, "uuid": "e7a57491-17dc-4e31-aa17-a417da56b11a", "value": "36d18f8cb3bee16af0421e6a936157a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644316100, "uuid": "e6cd1487-b2e4-4fb6-9c2d-d3b6bab3a149", "value": "12288:lBseOTwOg957PAMTEFv49thrFcmxLFwD7wGcXbtzbEOpUDlBoawsoei4:keOTwOUPnTC49LJxJwaCOpUD7roei4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644316100, "uuid": "9023ce8e-d9e5-465d-abe8-26ab2c20a664", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644316100, "uuid": "5204aa90-7712-42d3-9459-ae0f3ab3cc61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644316100, "uuid": "32efae32-6cff-497d-b19d-2b41ca0ba482", "value": "cce42fb42fcacac94f97a17352557952", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc4989f-889e-11ec-9275-42010a9c0029", "comment": "Malware payload (LimeRAT)", "timestamp": 1644297487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297487, "uuid": "9dc7eada-ae56-4b28-8bec-39016a66128b", "comment": "Malware payload (LimeRAT)", "value": "88bc72551a881d9daadc0c34d37dc5b3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297487, "uuid": "5c20dca6-58dc-4626-bee0-2abbdc698c89", "comment": "Malware payload (LimeRAT)", "value": "0d3f950913a4e2b5fff1a90b672ed9539b8d80475d385983aff6a83240d8a8d4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297487, "uuid": "c777577e-e3d3-4e89-b114-e33bf88b6f6c", "comment": "Malware payload (LimeRAT)", "value": "4086b0f3e158b76ac5d6038d5bd735c64c330efe", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297487, "uuid": "7e2baf1d-c295-4ecf-ad89-1c8218462fd7", "comment": "Malware payload (LimeRAT)", "value": "000109bebeddc721bfdc20676efbce20f9c0fd68d5b2c0f527482653bb8b66a68b21167ee403ca77815ec6e431198aba", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297487, "uuid": "79f3ae61-f8cb-4fbf-90c3-076376007d74", "value": "T12A94AD796B8D68A946E07C7733C667B0FD74E55BD62853132E82737803894F06EBA834", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297487, "uuid": "765ee34d-bfe8-4740-9b12-c22d375bc249", "value": "6144:TfdnFl/Nk5Pfeln4Ew69mtL1h00JPE7zMk0eeHv2qlJQb2bime1Ir2bXFbj7Fz+t:RnFVoJ5NcYllJQKle1Ir27N7FzhW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644297487, "uuid": "32350d46-cb96-4f2c-a239-34ac8b9d0630", "value": 436061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644297487, "uuid": "b5344698-39da-4dc0-8785-abfc3102d843", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297487, "uuid": "0d86e1b0-4c2d-44ba-a9d2-79a689342447", "value": "Faxx Document.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65691142-8881-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644284987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284987, "uuid": "29fc9739-fd01-4722-b5b2-3fa02e8b5f91", "comment": "Malware payload (Loki)", "value": "cae187a3cec863288a1d5505c7d46405", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284987, "uuid": "c76ca378-b189-4d41-afe0-52d7914a3a67", "comment": "Malware payload (Loki)", "value": "0d4b7a493ffb322f46927f4d290740e9157c549cdb50db1ce746065332ed317c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284987, "uuid": "14c5ec50-0536-46cf-8274-b045805a5c05", "comment": "Malware payload (Loki)", "value": "32238137cf6b343714429c6705891cfd8c447dd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284987, "uuid": "72c57336-8199-4f1c-a78a-a1a72262a59f", "comment": "Malware payload (Loki)", "value": "f23bf17e6e54cb3c07c979d36e7fa82fad1b5b1b441eac121887710dbbc84e5f74444992590c41e7a0ceda7eccd37468", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284987, "uuid": "38eba65d-ab8f-4492-bc88-75937894af7d", "value": "T127E4CFAC3651B5EFC41BCC729A683C60AA3031B787CBC6039167169C9B5DA97DF104EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284987, "uuid": "8f194275-6bed-481f-bc8b-3dae6bf0bf14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284987, "uuid": "3288c137-b498-41e4-9eee-5bb5b0722b17", "value": "12288:/TidYSO+bmR9hUayFPghZclqJ+oDzUBNqXqJeQ9vOQCcCpQwxtO8OO:/1qqUL9gZ1DzcNMqJeeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644284987, "uuid": "389f1adb-51c3-465c-ad52-d73a43856f21", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644284987, "uuid": "a11ade6b-3914-4735-8daa-9a2fb96c4ad0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284987, "uuid": "00cd467e-1da4-43e9-8c6a-aec7a4d09508", "value": "New Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf0b008-8899-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644295547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295547, "uuid": "717501fb-3044-45fd-8170-cc0d1f367f0f", "comment": "Malware payload (Heodo)", "value": "8fe3f1cb6ad2417e29bc79f4aede1fb1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295547, "uuid": "56a0b954-06b1-4644-b5d2-e6237adaa087", "comment": "Malware payload (Heodo)", "value": "0d64dbed0813f0cbdec1e54c316d0978c3c6b19e7aadb6b8485e754d3e051736", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295547, "uuid": "fc2d4c14-0ffa-4d29-bd27-e3bcc2f9b132", "comment": "Malware payload (Heodo)", "value": "e6a80cbbe8e5f6f624be179100da431e2dce5ad5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295547, "uuid": "0690809d-ec45-4414-b54f-f2e4334f55d4", "comment": "Malware payload (Heodo)", "value": "807436ee77563f5256569dfa5a8cd3f6bb382f007d2e8144ce464f9cc4f017a9c636bcd04914eda1f79ee616bfff0165", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644295547, "uuid": "a10dc8f4-9922-443d-a813-8c4f14199714", "value": "T1A493F16D6E1C290BE1CBE135DF3CEA6083545DE06662B8B664A13E7D403D4E3C175E2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644295547, "uuid": "85a9f29a-ba9d-4743-b40b-e8db1abda42c", "value": "1536:zZRkPTm/3ufvjuJ0f4N6SKa3Xm1WBXz7yL64i+kkfa+3gtfvjHtoxzg5bjIFaT:zvk7mfuXo0Ra3Xm4nC5X5gxvhoxzMIMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644295547, "uuid": "cb3ec95f-a0ad-4c2b-ade3-83b155a47b16", "value": 94226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644295547, "uuid": "0c52a6be-d48d-4993-a190-e60fda1e55ca", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644295547, "uuid": "9b3ea1d1-daaa-4898-afac-94db96d22c0e", "value": "tmpmtm39v5r", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0ac5e5-88bf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644311840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311840, "uuid": "29e37135-959d-40bd-a4da-32ba5ebc49a5", "comment": "Malware payload (Heodo)", "value": "102a775e9db94aa7e0df119f4f386566", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311840, "uuid": "ebdf37af-8b0d-4021-81b2-0e1a20504c9b", "comment": "Malware payload (Heodo)", "value": "0d6bd4bc03a40ce4c28661e23c3bfab2abeaaaf9dcd52802a385f8e51c22a51f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311840, "uuid": "33e78e8d-8f1b-4d8b-8ed4-570524a6797e", "comment": "Malware payload (Heodo)", "value": "c0837a17fc6e8a92938bff33979279acb6d4f770", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311840, "uuid": "28e4f838-ddb7-4fee-b95a-faf6bc9b4f9a", "comment": "Malware payload (Heodo)", "value": "a4ae8c665608c4270534fe2cf96b019045f092340d85045c81abda00b84a1885b3ffb41ba883ebd39c85b7b3735b36aa", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311840, "uuid": "dda64cee-8e6f-4355-9a8a-8de3995827b0", "value": "T1B5C36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311840, "uuid": "e0ad9570-1328-4b73-b6d2-f943d59b36db", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644311840, "uuid": "9c990702-854f-4e06-a2fd-ccef9b99f6dd", "value": 127723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644311840, "uuid": "e1303057-c8f8-476f-b6bd-ab38841e924f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311840, "uuid": "7210d092-3a20-42b9-83a7-5d4812fc58b0", "value": "tmparw1cinq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7c8505-88ec-11ec-9275-42010a9c0029", "comment": "Malware payload (sLoad)", "timestamp": 1644330875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330875, "uuid": "74bbeea0-8278-4479-80fa-6763c11b1d6e", "comment": "Malware payload (sLoad)", "value": "73284816cf3182f446536c380f805b1f", "object_relation": "md5", "Tag": [ { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Pec", "colour": "#50C7DE", "exportable": true, "hide_tag": false }, { "name": "SLoad", "colour": "#1A35A9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330875, "uuid": "9d9e18bd-cf65-4a55-a2d9-7c901a6c5629", "comment": "Malware payload (sLoad)", "value": "0d6f4f65cc73dfdde19c32e341ec6ab8d764c6fb0e725567c1c566fc55e006f4", "object_relation": "sha256", "Tag": [ { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Pec", "colour": "#50C7DE", "exportable": true, "hide_tag": false }, { "name": "SLoad", "colour": "#1A35A9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330875, "uuid": "10ee3d9b-8e54-4166-bc7f-ba8cfad1be88", "comment": "Malware payload (sLoad)", "value": "1f76add240b143994e24b9727983558c2b594371", "object_relation": "sha1", "Tag": [ { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Pec", "colour": "#50C7DE", "exportable": true, "hide_tag": false }, { "name": "SLoad", "colour": "#1A35A9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330875, "uuid": "a4569a54-96fe-40f5-a40c-a4d227aed887", "comment": "Malware payload (sLoad)", "value": "ed6c2329a92b2eadf8e2064c9244966edd7af5138742d5d5d9acc354e6886dbd7254c91ce4b40ec4ad4ea800e13f7a8e", "object_relation": "sha3-384", "Tag": [ { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Pec", "colour": "#50C7DE", "exportable": true, "hide_tag": false }, { "name": "SLoad", "colour": "#1A35A9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330875, "uuid": "c779c519-5286-47c0-a70b-26298e3928b4", "value": "T10F82E1F86945292FCF54BABC5AA71E1758355203EF116EF0C66D88113203B4F6E98BD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330875, "uuid": "125f68f8-dba8-47af-97d0-4dfdd9b34751", "value": "384:x1caob/SN2vJhuXM7xbc1+UciPeajPpX5DgnE7LeE2c2WkY/yIvZNPrJkLV:TcaWqE68xbkPeaLEnE/eE2c2PY/yYbJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644330875, "uuid": "63cfc83f-4be8-4dc7-9670-66dc9b776856", "value": 19184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644330875, "uuid": "054417df-5562-433f-b1f1-7eb3158ee4fa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330875, "uuid": "3fdb01f7-fdab-4064-98e4-e97999aa8c8e", "value": "doc-import-contab-15403501008.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ff30c4e-88ce-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644317969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317969, "uuid": "c01f6fca-5240-4df1-88c0-f2c80bfd6b3c", "comment": "Malware payload (Heodo)", "value": "3047bb2d9fbfb47f2ec2123ed55db22c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317969, "uuid": "33dcaa10-97da-4281-a59d-64dac49cf998", "comment": "Malware payload (Heodo)", "value": "0d7f1afa1a1224ec6d6be74e5b5be41a8b66eb229ca010ff2e1493bb765ae8f2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317969, "uuid": "3a784ba1-37a7-4576-82a2-bccde86a0279", "comment": "Malware payload (Heodo)", "value": "d6269f5a43e2160fbd6a769707a4c59ffbd5d374", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317969, "uuid": "7da6c2df-bbc1-4e13-9531-fcc3e6b2d72e", "comment": "Malware payload (Heodo)", "value": "9d203d0d59826d56e56787d16d64c119e0ffcbc58c0543a554a1c43518f1a0da0821e98b312a75bd6107867b847a305c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317969, "uuid": "1073aed0-3ef8-47f7-80f5-4cd6e3ef5520", "value": "T1D2C36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317969, "uuid": "daccc3b6-17d9-4e1b-b447-916392d5a0dd", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644317969, "uuid": "3e8ba142-02b2-48be-a889-b8f6025d4ec1", "value": 128546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644317969, "uuid": "41f0a8bd-1544-4d27-b704-44a6c723ca70", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317969, "uuid": "83141513-7ee3-4419-8ffb-1f2554b6971f", "value": "tmpjmiah9_d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f8fb78-891d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644352067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644352067, "uuid": "3618f9bb-2c0d-4107-905b-416671b75834", "comment": "Malware payload (Heodo)", "value": "48fa81966d1a866d874c87d8c51cc9cb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644352067, "uuid": "f5f031b6-d3c8-4e2e-96b2-0a02135cb983", "comment": "Malware payload (Heodo)", "value": "0d8d84757ad1ac1d674e9d57b87a57e901d5bb625e3d9fe4c0354d2c69becc05", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644352067, "uuid": "d462c317-87df-45ac-b420-e81ef5e34d98", "comment": "Malware payload (Heodo)", "value": "c97183730e3401141beec45361da1622229431f6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644352067, "uuid": "79481838-0b60-4d36-a570-99aa6f743f9c", "comment": "Malware payload (Heodo)", "value": "9e695a07dfe7abe73c3d82eac502beb2ab258a93c2e2d0be79f0220fa46476a13bf607def1510f906c8a736b389a842f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644352067, "uuid": "e8188740-4ce7-4d05-bb30-463f86cbc1eb", "value": "T1A2C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7C76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644352067, "uuid": "a02a5e4a-f90e-4b5c-9d0d-8a5cb1885e35", "value": "3072:BxcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBi:HcKoSsxzNDZLDZjlbR868O8KlVH37kea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644352067, "uuid": "6f67c5c8-dad9-4654-ba64-c3b36fc7a4eb", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644352067, "uuid": "6b29688e-80f6-41aa-b608-f54db35e463e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644352067, "uuid": "0ef1616c-4e63-45b3-ac64-7b62157b6e62", "value": "tmpr7ubqum4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6cb3068-887c-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644283030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283030, "uuid": "5f7fd072-9c52-4d31-a4c9-8f6138ca1f85", "comment": "Malware payload (Loki)", "value": "b366ff763c909f760f9cb0a6f126dcf1", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283030, "uuid": "d8addfdf-bde8-467d-a89b-db57c98821f5", "comment": "Malware payload (Loki)", "value": "0df4dc8ae347545bffa537520df0a614d2a996f0021e4b7ced78995da8330797", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283030, "uuid": "1ef7d98b-5c1e-4793-91dc-4f07f635ce28", "comment": "Malware payload (Loki)", "value": "0b5481b351f55ca615ed0fafe0fc714a33720b0e", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283030, "uuid": "0a77511d-acec-48c8-b7cc-3261ddb68a55", "comment": "Malware payload (Loki)", "value": "e6a57c8a40a6c02e93e66ed02ed66be6c794b778e0249e8e545b1d5945bac0293cd6b1c9905ee693f49582bbe493cb1f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644283030, "uuid": "5d7b9b73-8fb5-47a6-b09b-a45cab1f00c4", "value": "T1631412BC75DAD008CC5E353549A812864E7CCCB2E711107B837BB9462736EA7BE97B20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644283030, "uuid": "83031b4d-49e0-474b-b162-6555d2f75308", "value": "3072:X0TKX60PsE7tCtakjGWJvvmfXbAHZbksVPB0tz6rAC87PTs:ETWlEEmlGCmvkHZ4X16MhPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644283030, "uuid": "a113658b-e072-4b62-8b39-5da0c33142c3", "value": 191880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644283030, "uuid": "2c784afa-775b-4a91-a056-fc82eaae5bba", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644283030, "uuid": "b37d1ba4-5465-4ac7-a6c3-3314418f0f1e", "value": "50% Swift.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81683149-88d4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644320682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320682, "uuid": "81589dd6-455a-4206-85c0-b6b8839515ff", "comment": "Malware payload (Heodo)", "value": "77cf6d664e949888686d7989fd843cff", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320682, "uuid": "e18faa57-e3e2-4c5f-b9af-81907df675f7", "comment": "Malware payload (Heodo)", "value": "0e0e87a7c36384dc5733dc2a0ad70b0d6c481e088da6a675b5be1b28ac063b6a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320682, "uuid": "fc0ca8d8-93a5-457a-9c6f-41636c7640fb", "comment": "Malware payload (Heodo)", "value": "cdfebe225aad4bbf0903176ed09c72ee63a36386", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320682, "uuid": "4dfc213f-85a0-437d-9185-58d57fdd6697", "comment": "Malware payload (Heodo)", "value": "52fc51f955a84bf92664a6fb8ff95483b628b3a2cb6f3444c8dccfd8d12e84f5d40d09218a5eb50e3dcc5c3aaa49a4d5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320682, "uuid": "378f1a93-8c1c-4ab5-9d22-dddfbb79ec8c", "value": "T156C43A12AA82B0F1C79C813EB3F97AEB903F146547AA76D34FB18C8965EC0D119F7911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320682, "uuid": "d7630195-07f4-492d-8867-76f4f00965ce", "value": "1059dec3a72d4c311e39c8fc33d5af98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320682, "uuid": "f72e73b7-7563-471c-ac36-1524685377bc", "value": "6144:PQXvqLl4JINqB9QqbJq9AbuR/RzZ+fR5c96lnVPk5XtlOkiETHyROnR:oXvQDQVq9Ac5ZuR46lRkzloEzyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644320682, "uuid": "09462a37-ad32-4ff7-ae1b-cf0dd8e26cf9", "value": 596992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644320682, "uuid": "ad91c6ce-a639-416f-a200-3f5dc2e88541", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320682, "uuid": "ff3fcbba-39a6-4804-93c9-083906e563ca", "value": "emotet_exe_e4_0e0e87a7c36384dc5733dc2a0ad70b0d6c481e088da6a675b5be1b28ac063b6a_2022-02-08__114433.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d6c548e-891c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644351411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351411, "uuid": "65ccb233-01fd-4b92-80a5-a01cd9401c20", "comment": "Malware payload (Heodo)", "value": "859f8738da9ef0a9667a473ae8b2f0ac", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351411, "uuid": "68b74d0f-ae40-42e8-9508-d6259dd13cb0", "comment": "Malware payload (Heodo)", "value": "0e173f0615ab011dd1a978a6a4822c8990b202aa0019cb55eae6265665295f23", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351411, "uuid": "4930656c-a5b4-4adc-b1e4-ec0c740055cc", "comment": "Malware payload (Heodo)", "value": "6e2946fca0fdf4fd266e88f7c93759a77529908a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351411, "uuid": "18de4ad4-6419-4fba-8480-89a0082ca1b8", "comment": "Malware payload (Heodo)", "value": "4f6a44dce01054400d656f546c2959b48d04a432477d6c43a7787583c62333d66866039dce1868181df7f1f84dd922fc", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644351411, "uuid": "dbfc7491-38a7-41e2-91dc-9f6ef890c727", "value": "T111C35A55F685EA1ADE0812350DDFC7F9733ABC828E9683473289B32F7D76590CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644351411, "uuid": "8c140ac4-0d77-4383-9285-e254dff1bf78", "value": "3072:H/cKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBC:fcKoSsxzNDZLDZjlbR868O8KlVH37keq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644351411, "uuid": "9b2707fd-8d04-44bd-86b0-99c2de52f865", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644351411, "uuid": "17de721e-1f80-4a55-a4b0-9c25e5b1dc16", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644351411, "uuid": "9f27564a-bb56-40f1-a8ec-1db209daf9c6", "value": "tmppwx58dbx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a5b469-88f6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644335245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644335245, "uuid": "f8d092e0-2179-41db-a00e-9d69a4d33613", "comment": "Malware payload (AgentTesla)", "value": "79ef4888430891a016426394fe66a6b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644335245, "uuid": "3e5eeb42-4866-408e-872b-f582dcf42875", "comment": "Malware payload (AgentTesla)", "value": "0e3042d777d3ee42b58aa9f3ebc62368230e88d09dc2eead6297f31d373e8017", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644335245, "uuid": "0ae4a683-76bc-492a-bcd3-16eddda58578", "comment": "Malware payload (AgentTesla)", "value": "7ef65c61ae65a443a159d5df780f5a5fafd4112c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644335245, "uuid": "c62e043e-289f-4ed7-89a3-4e15d5ae4855", "comment": "Malware payload (AgentTesla)", "value": "2f50425ed93eb8ed8d9ab810a7f1018ab2549969f37ea112c0b2e98e086ebac2f21e831ae3e23131c9d9055fd94cdc0d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644335245, "uuid": "936d23e9-5b09-4c50-9ca0-13e3c5d96c7e", "value": "T191242A5A6714D451CB6F417FC01AC11831F1EB07A72AD38F59A2D8F91B822CEF92B8E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644335245, "uuid": "18ad0cea-fef8-4190-9614-8eb9fa4f8722", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644335245, "uuid": "620300f2-fc9e-44f6-8832-c92ad425875c", "value": "3072:w9V/BLs+Vx4yvUM4oAwoYg7dUaX6UA+JYHpG+OPf3EQMyBzYLpEYHNXUrUydRxNU:wRkM4oAwoYg7TqUBnbPEZHNPSRTFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644335245, "uuid": "0c890efc-677d-41ba-a809-6d0ee680fa81", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644335245, "uuid": "42870c80-240f-4ebe-98a6-128795cfd63c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644335245, "uuid": "a8fb6d3d-b8dc-45ed-bcec-f7ccd1375eb5", "value": "Euro_swiftcopy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad1b63c-8902-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644340401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340401, "uuid": "386af714-2180-4295-96b8-fb3db2d8ec8a", "comment": "Malware payload (Heodo)", "value": "ad48759ccc7c2e5f7293186d6e915217", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340401, "uuid": "a69e78e7-6c81-4ccc-8a2b-f89a705ae33b", "comment": "Malware payload (Heodo)", "value": "0e4ecaa333072aca6ec5d94a0f96f53c34c838ea933858c2744f8156ca0937cc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340401, "uuid": "2ebb53bd-13df-406e-9b16-cb63119bf544", "comment": "Malware payload (Heodo)", "value": "496272ed9632094b71fbe212cd2a047b67344613", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340401, "uuid": "52fc20cd-d00b-47de-a240-1d8cd3c9d36c", "comment": "Malware payload (Heodo)", "value": "8d84d048fe71f47c4e919ec419e0b82435e58ff3b625ea5f0646ddc51f2740ba760d7b25c453b7d18dcc014b7e1e0983", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340401, "uuid": "fdab9de0-8373-470e-aef3-cc5a4a991ebb", "value": "T119C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473299B32F7C76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340401, "uuid": "38beac80-d167-4281-b4e1-44a7545a002c", "value": "3072:xNcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dg+Bb:/cKoSsxzNDZLDZjlbR868O8KlVH37ke2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644340401, "uuid": "93e173b1-e0e3-4d64-8467-09735d4fad22", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644340401, "uuid": "a27f47d4-9abe-4072-86ba-9a67bc9c8017", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340401, "uuid": "964a1c96-c536-4107-8732-4d3b1647ead5", "value": "tmpqb66rggo", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f51352-88aa-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644302654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302654, "uuid": "f3200887-f60a-40a4-86c4-6924cf844606", "comment": "Malware payload (Heodo)", "value": "f39d9c2a476e384689749f9f9297e90a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302654, "uuid": "b9a821f9-d3b4-49a8-a985-48e55ba442c0", "comment": "Malware payload (Heodo)", "value": "0e7e91a609244a15b306b4f96d4370b1ac684d906baa0d42f50dff81102b807e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302654, "uuid": "a5242d81-f91f-4fc4-9eb0-7d2411949dde", "comment": "Malware payload (Heodo)", "value": "4d716c8d14f347e34b88385d9c83e99e83277559", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302654, "uuid": "d9441fb8-8f72-4ee1-a6e8-2c573aaedc52", "comment": "Malware payload (Heodo)", "value": "6a8ba7a04d2d12ebae744a14848db910f45216607ae408db9d80c0ccf58c55cb635ec7fcdfbf03650e7064ad7c532890", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302654, "uuid": "5ebed741-2c82-4b5e-9ac6-5600f2e9f3a4", "value": "T13C93499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302654, "uuid": "8107cd73-7a53-4641-86df-3f269d385108", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644302654, "uuid": "129cd4a0-b0b2-4e01-aade-bd401480df10", "value": 97362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644302654, "uuid": "ee44799c-9024-4c49-879b-f012516b2f5f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302654, "uuid": "d3bf7cf2-f324-460e-b114-68ccd0e01329", "value": "tmpkyro_iyv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f242bde-88e1-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644326289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644326289, "uuid": "68ecf460-753a-4675-8d2e-407feb4ce6c4", "comment": "Malware payload (AgentTesla)", "value": "329965fa74e54877b593f32a7ddf455e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644326289, "uuid": "597b9d7e-8c1e-48e9-b75b-af3c375ea5a3", "comment": "Malware payload (AgentTesla)", "value": "0e82847f4621d454773440b084d8c40c0729cb9067999e708586f4b458c2c2f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644326289, "uuid": "942dd1f8-e347-4a51-82d6-94416aca7ef5", "comment": "Malware payload (AgentTesla)", "value": "e1cb8e3bc01f87b18e6861cfa2e77fd998d66daf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644326289, "uuid": "32faa733-09e1-49ed-9839-2f7452913a14", "comment": "Malware payload (AgentTesla)", "value": "154b585a2ce020b8040ec40d7ac7136b47ec7b0fc502a6356db11a1f800b32be584574e5ca9a643956e68ff1b14f305f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644326289, "uuid": "7eb5c2a5-88f6-45fb-ba8c-cfbc62d2e37d", "value": "T104B402F903BC8F1BC9FE0AB0E034618093786246DB57E70F7599A0ADE9573959E112E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644326289, "uuid": "f65623e7-aa33-4575-b4f2-b50d44b9eea7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644326289, "uuid": "78b34e99-18ad-47be-b409-b0b51d7857d2", "value": "12288:4geBGxUtx3EWNl8SyHCT8Tjc7zrqEqEm2KJpIdLE:4ixUf3TCO8TjcPUEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644326289, "uuid": "15abca09-c616-4bec-9fbb-c4527b5ebab1", "value": 521216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644326289, "uuid": "f4a93f57-0dea-4c25-8a6d-a2d1b6b3b651", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644326289, "uuid": "f760fab0-fcd5-489b-a46e-6b3f2e0907f2", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818137e4-88f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644332708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644332708, "uuid": "5b6cfaff-8aea-448e-847a-b8d605b61580", "comment": "Malware payload (Heodo)", "value": "82b897dd1cae194c05930b014f4a9ba2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644332708, "uuid": "8d504d47-f77b-4ce4-a0ef-49266c9c2fc6", "comment": "Malware payload (Heodo)", "value": "0e8dea2c6d05e49ab1eed2fd9f9f22b667cb4ddb5886d6d71f32055ac8b588ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644332708, "uuid": "02120261-954f-4cad-9078-fbd144442a41", "comment": "Malware payload (Heodo)", "value": "d23b67f2885a9ffe801c2a96f661482707d2326f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644332708, "uuid": "e02cfd4e-9aec-4491-b210-cc00026ce12f", "comment": "Malware payload (Heodo)", "value": "2a25f14a512afc258b1d2e135002c0b1e1e91ef69761bf736fe04ecf938628c7288655da0bbad6f6bcbd2c1640828093", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644332708, "uuid": "389916e1-55a8-47c6-ae40-bf581a0169d8", "value": "T197F4C0006582907AE4F930B842667BF1E93D1CB0372511D39BD069FEA6E41F1B6B376B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644332708, "uuid": "d8a202a3-2fad-4cfc-81ed-428b51c3b71f", "value": "36d18f8cb3bee16af0421e6a936157a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644332708, "uuid": "ced3b27f-ba8d-40a4-8fa3-54916d00e30d", "value": "12288:lBseOTwOg957PAMTEFv49thrFcmxLFwD7wGcXbtzbEOpUDlBCawsoei4:keOTwOUPnTC49LJxJwaCOpUD79oei4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644332708, "uuid": "133b33a0-0aaa-497f-9980-84d96800d738", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644332708, "uuid": "966563a4-237b-412d-8b26-4dd35890549c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644332708, "uuid": "11424994-a3cd-4314-9f7f-73cb2e8bc837", "value": "82b897dd1cae194c05930b014f4a9ba2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d663cea-891d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644351921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351921, "uuid": "e9e00496-4bf3-4448-9187-c5440fa6e8f6", "comment": "Malware payload (Heodo)", "value": "b1d95b8e1f10ef9b520ac45fc35c7a86", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351921, "uuid": "3dbd37e8-7fe1-4d5f-8386-4677d620c013", "comment": "Malware payload (Heodo)", "value": "0ebb5a1e01df566c186da7742b26ec5fa4efc4b7594b3df5727829e880f39745", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351921, "uuid": "0b0f4793-f730-4eb6-befb-c6d6e0bcc314", "comment": "Malware payload (Heodo)", "value": "b4a861dcd5a96c1f9327ba6c6b64900559ee552f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351921, "uuid": "e53f0e62-d70c-46c2-8176-abe43f18edb9", "comment": "Malware payload (Heodo)", "value": "fbbc0a93e6b5eac15f07723e80b1f78b7e73fb3feffd397e3d32fb35dbacf6ee4b27b360ce6a0fa10b626bdf13da9a40", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644351921, "uuid": "56018c57-b823-453d-8919-7d20c6ac3250", "value": "T16DC35A55F685EA1ADA0823350DDFC7F9733ABC828E9683473299B32F3D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644351921, "uuid": "507ec3c0-e3fe-42ca-b6e4-b300219faae7", "value": "3072:0zcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgiB0:0cKoSsxzNDZLDZjlbR868O8KlVH37ked", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644351921, "uuid": "d447a3da-9bb1-4be5-85ba-3ecd34f19119", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644351921, "uuid": "dc1cd9e4-a673-4126-9add-aa8642e0ed41", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644351921, "uuid": "a278509d-c3e0-486e-add4-787ee4edbca0", "value": "tmp4un3gsif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba22dc3d-8882-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644285559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285559, "uuid": "0061407c-65f0-46f6-baa1-78d068908cfd", "comment": "Malware payload (AgentTesla)", "value": "f3f7a3916f709a22a51cde0483274999", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285559, "uuid": "eace33b4-10ac-4db2-a428-af1553e89fc3", "comment": "Malware payload (AgentTesla)", "value": "0ecdaed3a2f731cdf1a09bb7aa353d3c9dabb5898409e249edb3dbda64569cbb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285559, "uuid": "3fd7d87b-2d4c-44cf-aead-edf88eb15c42", "comment": "Malware payload (AgentTesla)", "value": "c45462ff355257070d83d1e777e2535405337fe8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285559, "uuid": "aee4fd9c-8d07-46f5-acca-abbb2cc5fbb4", "comment": "Malware payload (AgentTesla)", "value": "db1fd92ae33cefdc12d9948eaae97d996254b1e01c9370f2d39e254e93f821348e7a6dcdef3d220f6dc10be053f4d70a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285559, "uuid": "343ee8e7-d3c8-4d9a-87be-0389a700ddf0", "value": "T1E0D40147BB0F5652C569A9B264DFE07747E52BF67B33DAA82CC0334C09413E28E14B99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285559, "uuid": "c1b1a380-b1e6-4fdb-a83d-f92f90d2103c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285559, "uuid": "8168fda4-7ead-41d2-8abf-925792c21bac", "value": "12288:2Oe1Vnc2jIvJgQBxJ2ECM9vwdSwwKwgk/Lel:2Ot9rT3w94/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644285559, "uuid": "6f217e95-7c15-4034-bb8e-675a0dbf95c8", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644285559, "uuid": "81a6c563-3394-465f-87d7-e6c1a7cb80b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285559, "uuid": "e1b61d60-6459-445d-9aa3-7768a305cb0d", "value": "STATEMENT OF ACCOUNT February 6, 2022..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f1ddfa2-88aa-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644302452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302452, "uuid": "7302ca42-e69c-4da7-bd15-0b911e296886", "comment": "Malware payload (Heodo)", "value": "50a29161c1ab5e186c99986efce2bc6b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302452, "uuid": "8f54cace-7998-4230-8d37-d75657025d75", "comment": "Malware payload (Heodo)", "value": "0eff031c831d57529e6d44e2731461ac9369e644f40812befb78f644075a5513", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302452, "uuid": "f4090bea-bc1b-45e6-bb04-e825b395ad81", "comment": "Malware payload (Heodo)", "value": "b7bb4a4e834b04174c524815bdb8333b3e59662d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302452, "uuid": "fedbbc47-dbf7-4d50-9850-60252963b9ee", "comment": "Malware payload (Heodo)", "value": "e243fc3eb5a17b00a4deb899d59c61c8372e72ee5068b0f08a8dce728dff67e1752f3ee6ecc3f73d322ca731dd04c31d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302452, "uuid": "c3dc145d-5301-4c5e-8a0a-9e54a42649fb", "value": "T119F4CF01B642C07BD4E920F882677AF2DA3D1DB0632511E75BD459E8A5E42F1B6B3B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302452, "uuid": "cfff76ae-02ce-4522-a898-a30f6d6ce3b2", "value": "36d18f8cb3bee16af0421e6a936157a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302452, "uuid": "a52e1edf-5b58-4459-af10-4c1f24950a1a", "value": "12288:0dxTcumr82wywP4LHIVBIAeQwfUgFm9V5BnE+skDSBNOgl16gtdXkX:8TrmrRwP4kVfw8gYtE+skD+NUgTXkX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644302452, "uuid": "1b7ef8ee-3bb1-4d15-ae2f-7e8c4b653c02", "value": 781824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644302452, "uuid": "962e399d-af32-42a4-9b55-68b38a6edd5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302452, "uuid": "7bbccb86-4d66-4196-8671-29aa8658d90d", "value": "emotet_exe_e4_0eff031c831d57529e6d44e2731461ac9369e644f40812befb78f644075a5513_2022-02-08__064044.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf2929d4-8901-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644340140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340140, "uuid": "f5fc5396-4e02-4fd8-b7e7-c393eacc5ed7", "comment": "Malware payload (Heodo)", "value": "a3bff1457bb0f640f9d34517daf91d91", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340140, "uuid": "fc48653d-d446-44ae-b93a-13ada4f413d2", "comment": "Malware payload (Heodo)", "value": "0f05e7f21e4a27d472c0bea2cab9816d10b2cf6dd61916ac42438eb9b68fde8c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340140, "uuid": "f49f6e62-fd6c-4c1e-a7ac-5bb038b06d03", "comment": "Malware payload (Heodo)", "value": "a63902b337789c273a4c82870f5bbf0f72425cb6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340140, "uuid": "5f18522a-9cda-4fab-9bd7-1b2c90c20bd7", "comment": "Malware payload (Heodo)", "value": "1b395c1bd8d93ca767cb4efeab6f755124200f42e65cc069d4c98f0ae6856e91ea252c906d7bba468bb990aa501f7fc4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340140, "uuid": "d2395ab2-5842-4b6a-82bb-aa99e39b49f9", "value": "T1C7C35A55F685EA1ADE0822350DDFC7F9333ABC828E9683473299B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340140, "uuid": "79328284-754c-49db-ace0-6e3115d23cdb", "value": "3072:vDcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dg3BX:rcKoSsxzNDZLDZjlbR868O8KlVH37keH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644340140, "uuid": "7f93cd32-570c-45d9-81b7-90d24c9b3783", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644340140, "uuid": "bbfef1a4-fc8a-4834-b528-475291c245a0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340140, "uuid": "b087c383-ed71-4490-b44c-063060d483af", "value": "tmpl66mvq_e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3732c368-88cc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644317122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317122, "uuid": "f2ec652c-9e3f-47ba-bb6c-6ceab794e70e", "comment": "Malware payload (Heodo)", "value": "16570d5f2b01ba29d2b1f965de94092b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317122, "uuid": "760cf639-3d5f-4058-a333-14f323f7b14f", "comment": "Malware payload (Heodo)", "value": "0f2e90ccc04e9f37997f2f86e9ffd89d75a7d7f79bb833d60dd1ce3aee79a748", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317122, "uuid": "280ab9b0-e05e-4df0-b61a-5c0c9e992fbc", "comment": "Malware payload (Heodo)", "value": "a78cfcf95935c2a4d7bfd04dfceaefe3934450c8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317122, "uuid": "433668d3-9be7-4f30-b1ce-3ae0e66ec56a", "comment": "Malware payload (Heodo)", "value": "a2fbd65685aed882c1e136965db031d19a48f7081f7df28518fa4e61294c9622c4e50e10f6039804f2a45c2f7b3bbbf7", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317122, "uuid": "d4a2dfaf-243f-4e35-98bf-f9dc4f299d3e", "value": "T14993499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317122, "uuid": "3d80d415-a7eb-4ab5-abb8-d1e7f530d4e2", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644317122, "uuid": "4dc19646-d5cc-4241-bf22-44091dce9be7", "value": 96599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644317122, "uuid": "79d76a38-26fe-4c61-ba08-e490fd56b8e7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317122, "uuid": "049d1340-2121-4395-b8dd-51c533016a56", "value": "tmpz3qsfi3r", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d420c837-88cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644318674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644318674, "uuid": "28049f39-b265-42df-91c8-6c34eadd4677", "comment": "Malware payload (Heodo)", "value": "34395ab9d06d7b67c778cf0b4110200a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644318674, "uuid": "26d904cd-9154-403a-bacf-0814b805f364", "comment": "Malware payload (Heodo)", "value": "0f6e484fa3157c9cde4d2208047fdf099852e96ba21bfe48283b726ac990541d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644318674, "uuid": "58822771-9235-40d1-b2c3-18e23fc8a51a", "comment": "Malware payload (Heodo)", "value": "781ea078c2485be0de0c7e54833aa83df8586b08", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644318674, "uuid": "9e211998-6b15-4db2-b385-76ec37a04b98", "comment": "Malware payload (Heodo)", "value": "8165c05c11df4b2580e27a22d15c8cda546ad88bfead3b25d5e2bee2a6816989b771681c8b430d65da4c3616cf5bfae8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644318674, "uuid": "69647bfb-a208-46be-8079-5c099a70307a", "value": "T1F1C36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644318674, "uuid": "336c94e1-f11e-4bf1-bdcf-f03e01765ef0", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644318674, "uuid": "857519f2-aeaf-4dc6-8982-4fb51c277ed8", "value": 127587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644318674, "uuid": "ce70b2c1-528b-4dcf-a8e1-0bd4fbcacafd", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644318674, "uuid": "9898910c-d37a-415b-8f20-f3c7eff18726", "value": "tmpjcvt070t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff511efd-888e-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1644290829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644290829, "uuid": "0b167197-a1a4-4538-9d57-364f7520e9d2", "comment": "Malware payload (AZORult)", "value": "f80b19c4f5c977b44c26f2e7565b6896", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644290829, "uuid": "364e9151-a5e4-4e9d-b621-cd69ffe56e7e", "comment": "Malware payload (AZORult)", "value": "0f981debcc6e67dde58505fc76b59d00072e9b13237d1376fea5cf9f95e6e2ed", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644290829, "uuid": "e1aa9ea9-ea1b-4b66-8539-21f3e0100709", "comment": "Malware payload (AZORult)", "value": "e244aa3c983313cdaf46b0f94b74cadc2a570dbf", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644290829, "uuid": "c01b41ad-66e3-441e-9203-0e9b56c9f03c", "comment": "Malware payload (AZORult)", "value": "a332cd631909733160c2971d85230d9f809916a1aa48d2c7f374df858113869f133ac6c17e93fd41a1bb182b1ad557bc", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644290829, "uuid": "19cdff12-a1f6-4220-b40c-f4539fff71f3", "value": "T19194E4F871E1E27AC81182312E257C7183F54DA0DDB1A915EDECF9E4D530EF62B2264A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644290829, "uuid": "a4a5359b-776b-464b-8398-a6b09fda91e9", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644290829, "uuid": "cdd45e0c-15dc-4d2a-ab5d-0724e749e224", "value": "6144:BwTa4ogLeo9JEAIOV7ewoTzCC5LwXe6OoKXGfMZNtXRkhI:kJTvEj4YJ5XXGmXRkhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644290829, "uuid": "3a52972e-a98d-459d-b780-81c29bbfb401", "value": 414304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644290829, "uuid": "5db92358-231f-4a1f-b1d5-30f3f6c57b57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644290829, "uuid": "87c40a8e-b82b-4cb4-be66-8a198a5ef3c3", "value": "PO#58392117.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6e1cff-8931-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644360590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644360590, "uuid": "e963a3b4-7037-4bff-a0ed-6d0b8486919a", "comment": "Malware payload", "value": "43896adf9851803ad4b4b940f907f155", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644360590, "uuid": "7c794486-ebd0-4d16-b25b-b235036ff13d", "comment": "Malware payload", "value": "0fa0678d3405e38aee40b7ae71dc70da0364404b5db4031c25775e4091a24f45", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644360590, "uuid": "93c9220f-f01d-43b5-bea6-f66fa3db3e3d", "comment": "Malware payload", "value": "991ee0156e2d4e575dc1a56494f8820fd6feccee", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644360590, "uuid": "ad4af166-6d56-4f41-b485-db9888977840", "comment": "Malware payload", "value": "869774491237934199e1aa7553ce631812ce4aff7f325cafd3114f2e78188b94d25d56abb0ef0eaef2c37eefbb27a81f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644360590, "uuid": "52d66c9b-3d3a-4252-9caa-f9fb4c89cb6c", "value": "T1F4C35A55F685EA1ADA0823350DDFC7F9733ABC828E9683473299B32F3D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644360590, "uuid": "9932b9b3-f374-4ad5-b124-f3a68de124a7", "value": "3072:+4cKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgiBI:BcKoSsxzNDZLDZjlbR868O8KlVH37kex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644360590, "uuid": "d79e02bf-2e18-4a52-98e7-b2a0c528f057", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644360590, "uuid": "f3dad1e8-252f-40fe-9546-568837cb7c6b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644360590, "uuid": "f7da8db3-7805-46cc-b322-33b9a9aff06b", "value": "tmpkk5lawuh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "950c7fa3-88c1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644312555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312555, "uuid": "97f3bfd1-37bd-4195-8bbc-dd14f7ca91c5", "comment": "Malware payload (Heodo)", "value": "1e01f66a90ddff7cc643cc263371794e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312555, "uuid": "d215bbe6-38a1-4e74-a9a8-6ff44f85e765", "comment": "Malware payload (Heodo)", "value": "0fba7be4ebffd22dbc66f8ac67b71ebb8074a42eb2ede2c3a6fc69b1062f144f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312555, "uuid": "1b8794bd-1558-492d-b8a5-341d18c91a7c", "comment": "Malware payload (Heodo)", "value": "94ba693f242d9a371d845c406c0dda76de5c6d6d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312555, "uuid": "2af9b1fe-fb58-49cd-9a63-ee3d30050e2a", "comment": "Malware payload (Heodo)", "value": "828fe18bb009c3846ebb6c1cf150635f6fe78fd2843f70aa08a8cde054109c4b0080ea2794e5d225652a13baa80ae737", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312555, "uuid": "9cc1c446-4e9c-45ab-b7fb-2f6c98091ea2", "value": "T15AC36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312555, "uuid": "93e41ef7-541c-410f-948d-f1aa00e1656f", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644312555, "uuid": "66d76863-2636-40cc-8230-f5c3d105b352", "value": 127588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644312555, "uuid": "e25552b0-5ec4-403b-ba12-3ba9566bd630", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312555, "uuid": "bbc211de-5380-428e-89c8-a550e90adaa4", "value": "tmp7tb4ahn8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b88b8d-88bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644310246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310246, "uuid": "357c1ab8-f8b9-4822-a55b-5fe63ee96750", "comment": "Malware payload (Loki)", "value": "cbd1d0882c3cfdb99cfef6f41051762e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310246, "uuid": "49816bff-e99e-4624-8b2a-65cdf84bef6a", "comment": "Malware payload (Loki)", "value": "0fc6387b8941d4f41910df31f2623ba6159f450cc763e9e101dd9e1f98f0bc12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310246, "uuid": "4214205e-c983-4d23-8140-079c4bb6ddaf", "comment": "Malware payload (Loki)", "value": "8a4856fd380ce916625f607520953a2f7c5f08e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310246, "uuid": "a7830db7-d2d1-4cbd-90c3-6c465422dd8f", "comment": "Malware payload (Loki)", "value": "a19f8759dc167f4b6e9ec7008ba83e5ae541ee49145e501c9612778cc06218ba96d49b4573ce1923c5be857762e33a5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310246, "uuid": "c01fff61-b98b-407f-ae60-12946e6d2d06", "value": "T10B3423273AC9EC27D0A28D71A7B3C62CC3BAFF86571024972BA51F5E39553A4C2520D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310246, "uuid": "5a5835db-0648-4e08-8466-1f0ebb7518f6", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310246, "uuid": "3e5e46eb-35bc-4735-86b9-695293633584", "value": "3072:oNyah0mJoXBkO+uDqyLmlA5wHE/9jgvOfPphfVvfiYNfirttJ3BBAavFu+BVhvU8:oweQcAuhvO5jaYJiJ1BA+Y+BXv/fx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644310246, "uuid": "28fccfa6-cf61-4bfd-bd22-9f77a438f24c", "value": 235984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644310246, "uuid": "6e481c02-c59f-4d6f-8d56-688fa7012b46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310246, "uuid": "ede17915-7ca6-4c59-9116-be59d66c3b5e", "value": "cbd1d0882c3cfdb99cfef6f41051762e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ddde16a-88b6-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644307657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307657, "uuid": "410a1a88-f9c8-4dd2-8b52-25454aae16b4", "comment": "Malware payload (Formbook)", "value": "4fee9e5033cb88580688953f6793855c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307657, "uuid": "294644cf-fe2f-4198-8157-3170ccd970c2", "comment": "Malware payload (Formbook)", "value": "0fc9b9d191a7496ad1bd1aaf5f727487484f45dc63e34c7fdc5aaf69b158189a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307657, "uuid": "e7df871e-d1db-45f2-8951-c83a440c53ba", "comment": "Malware payload (Formbook)", "value": "74255271d3257b3a571d87cc42f875e54584501a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307657, "uuid": "e61f7989-d282-458b-bdcd-c26ed56a1344", "comment": "Malware payload (Formbook)", "value": "06760056b66ee26b65b9b13e44d53063e94d4655a474237c398a60f75273a89569a6f7a2945910a333de3a6d7a2c9950", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307657, "uuid": "11378bac-497a-44db-b720-82cd3d78aa67", "value": "T1F751927D3657B234A9623CA3FE0B941D55B09699203984E07E0C86D14F290BCDBD4E8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307657, "uuid": "99428c47-4ba8-4384-b2df-6066ee3cfb77", "value": "48:aeb0IY11lQy7Y6JWCKYkj3jNmW/AA3gYeOxh0/huD7gYuuKY+LL7fRjs:QIs1JJV1iNmgAAyhhXDrLLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644307657, "uuid": "3ca0b5ae-42a0-45e4-b6bd-3a286c8219fe", "value": 2724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644307657, "uuid": "f1d41d0d-3623-4070-9bdd-1cf1034d63f1", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307657, "uuid": "e9dcaea8-4346-452d-a700-7967bf9f4f85", "value": "MQ-3018.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e32f80-88d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644321755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321755, "uuid": "f4691c24-1c34-4f7e-b6af-7aec47c74a76", "comment": "Malware payload (Heodo)", "value": "8d0aee65673b309e4ead0a6c9f2fefb5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321755, "uuid": "7b0da520-d366-4505-bca6-b77bc84e6315", "comment": "Malware payload (Heodo)", "value": "0fcdd70b20adaede91389ae05cfad7f5af45c30b785afacecbbea37338c97975", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321755, "uuid": "582c5234-b780-453d-9012-6e7545f4d1e9", "comment": "Malware payload (Heodo)", "value": "866956d81ba36b73e5b1fe02a9349b3934a2bf04", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321755, "uuid": "6d24b37e-1f24-4105-8ac2-81709e36aaf2", "comment": "Malware payload (Heodo)", "value": "cd17d0d5ab0bc8081884691a16cbe5fd6de7b45d7bbf1a77000d6c1ac6bdb140a9a5c8e7a732241ba8bb5f8c4e783959", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644321755, "uuid": "1198c9ec-19c5-47b8-bf97-21c3633678d3", "value": "T1D8C36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644321755, "uuid": "dd6bde6c-a6ea-4f02-94c3-ff124a4da7cf", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644321755, "uuid": "8fd9936e-cb6d-4101-93ba-740425d25269", "value": 127713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644321755, "uuid": "13e4f5bf-9d1d-4e7e-bd27-b80906c4ada1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644321755, "uuid": "fc064387-d340-47e1-9d4f-9eea3d223e7e", "value": "tmp5g3pru_4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35af7ff2-892d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644358780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358780, "uuid": "d3d865d2-0e0b-4a95-b29e-846cd7a186bc", "comment": "Malware payload", "value": "44e4204201a5d09e60d1c83d92f14f5b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358780, "uuid": "830d6b44-01d4-4f24-954c-4e466fc1e8d3", "comment": "Malware payload", "value": "1022509a4e419fe66c5230f12ee9dcf2dd96c5f2b1a9a4ed1e37d38fa0ff3777", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358780, "uuid": "cabec689-1b9c-4810-ac38-3426267e6f66", "comment": "Malware payload", "value": "96a70e0e5e0e3c31d673aa496517cc8540d82dcb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358780, "uuid": "640eb00b-4188-4f22-8d14-bd5e4d8f8617", "comment": "Malware payload", "value": "4f24d9686f01a9ff3a8dd24c7fc687948f196d8d6cf05ac0ece1836b876f783c5c1eb04048b9d447d0cbb6c23719663e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358780, "uuid": "59ddd9ac-b23d-4b02-b7fa-43bd452578a1", "value": "T183C44B13E68398F1C79C803973AD7BFF802A155547E876D30BF1858869AC0E14BB7D9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358780, "uuid": "23af3242-0efc-4ebf-926a-dbcb3406eb2d", "value": "1059dec3a72d4c311e39c8fc33d5af98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358780, "uuid": "e8de873f-de4a-4656-99d3-c8b53dad87ef", "value": "6144:/mbbvqXJery1jH9OttfeRdq9r8BVBALMaXyc9e8h2qYJVwdFmFlE/S:QbvqX4+eKdq18mLRXLeg2jJ0F9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644358780, "uuid": "99140e98-ebde-4dff-9f0f-2152cb5dc7ac", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644358780, "uuid": "7933bed1-5638-4349-ae4c-ce6150ba5fca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358780, "uuid": "38dc85be-8ba6-4680-ba47-c7fc72f3bc44", "value": "emotet_exe_e5_1022509a4e419fe66c5230f12ee9dcf2dd96c5f2b1a9a4ed1e37d38fa0ff3777_2022-02-08__221927.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "518a92fa-8927-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644356250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356250, "uuid": "a8e12060-870f-4058-9940-e1ba131e3a83", "comment": "Malware payload", "value": "d9e5ead5d1a0e4612d79d2062338dabf", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356250, "uuid": "494d25f4-c48d-46e4-b403-4ae81fd1608d", "comment": "Malware payload", "value": "1058469e9a83566730e66d0d7a2c40070d7ff2955d4c2a944f55b2c897cd4578", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356250, "uuid": "4c558d51-24df-4853-9d80-4420e23ce9e3", "comment": "Malware payload", "value": "6e59a198e42f434fcae7c08ec2f85f4abdf07dd5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356250, "uuid": "f9192874-a345-4905-9b6e-fe5a6b085518", "comment": "Malware payload", "value": "dac47d71bb1a84df28c3d22777b7d04c7ec3342f838a6e0c0488d9e348f0c4af7accf513e6f9f863bba355b15c4b7b8e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644356250, "uuid": "38632964-5e7d-401b-8459-6f5d8b101e2c", "value": "T1C3C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644356250, "uuid": "fa616dee-c07a-473d-a6c7-eb0b0daf0da7", "value": "3072:lScKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBQ:QcKoSsxzNDZLDZjlbR868O8KlVH37keI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644356250, "uuid": "ab323047-e48d-4a7d-ba16-90a2a1ccbfdc", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644356250, "uuid": "ec2f345b-613f-40f6-9051-4002c2b202b1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644356250, "uuid": "2ed029cc-264d-481c-a323-000d5bc2d5cb", "value": "tmpqjohl383", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df5f45c-88d3-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644320086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320086, "uuid": "41f91a7d-d9fc-4bdd-9e5e-0cc1de4bb98d", "comment": "Malware payload (AgentTesla)", "value": "71a9134435bd9f4d18298a65341fb85c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320086, "uuid": "99176fde-0831-4914-8d1c-540bbbcaa4df", "comment": "Malware payload (AgentTesla)", "value": "10bd6fd1fcc936a139e2642a257e8d10b9e66ca15d26ad30f85a78aff7b7cea7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320086, "uuid": "0f1e8487-af5d-4703-96dd-6d63edfb374b", "comment": "Malware payload (AgentTesla)", "value": "50f766fa3c709072b8286100f4b19642e37cc761", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320086, "uuid": "37d8f708-1f50-4aea-ad14-12b4ca7006aa", "comment": "Malware payload (AgentTesla)", "value": "11aeda3721bab39465e262421854fba2f423572d171bceeb069cd5d1c99ba256df11d5fd90e2fc0288f3cd5f94e7056c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320086, "uuid": "0c1a829e-f7d9-418b-af81-b0928fc3248e", "value": "T167C48B3F49BF113AC6BDCB708894CE1FB822D5463977691D2A9226D905232F275D223F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320086, "uuid": "1cd9f71e-9710-4bdf-9cf1-3acebe44dbaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320086, "uuid": "09185b40-d371-4662-88ed-91d6d230b916", "value": "6144:C03NtdPmJDGqN0VqsI7mfN3XLQyLAMKcprH2/3M5VkPcszv1f8L+lR2ShHH+tPJ:FN0aw0BI7mfNnLQIA2pO3MKTiL+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644320086, "uuid": "7d3c4d32-b955-44e5-bf9e-0e5bbc11b309", "value": 575488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644320086, "uuid": "89961852-af86-47bf-9f1e-382f09d5e059", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320086, "uuid": "ad57b333-c0e7-4041-af62-81f57bbb51b7", "value": "IHARA RFQ_20983764_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6c7c4e-8935-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644362179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644362179, "uuid": "460cc800-b396-44eb-9c3d-08baf9343ffe", "comment": "Malware payload", "value": "27b6cdf1e427a2c1a88a7bb344f567ff", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644362179, "uuid": "276f5f2d-fab7-4b6f-baca-3148481b0482", "comment": "Malware payload", "value": "10d156606cca8b0825e3fcf34ae09c4ba258003cbdbae6ba8cd4540dae1fa689", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644362179, "uuid": "3c4d2d66-f41f-4377-b710-d49781a25165", "comment": "Malware payload", "value": "92f55e882195cc6e40d839a4f4b9198cc3ee5300", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644362179, "uuid": "340d88d9-8ea1-45f8-958b-0f173daf9710", "comment": "Malware payload", "value": "c9ae4babd20b6bf9ec50fd09ad103f31f05928be8f442f5a71d718aef2de9ffbc8d15ee7b7322fe02846609b390e767e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644362179, "uuid": "4cf0f526-77e4-4b9e-85cb-25864e8b6143", "value": "T1A3C35A55F685EA1ADE0812350DDFC7F9333ABC828E9683473299B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644362179, "uuid": "34868ae5-6a60-4c82-aede-09e9c54255e4", "value": "3072:6ycKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBf:fcKoSsxzNDZLDZjlbR868O8KlVH37ke3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644362179, "uuid": "97c26f2e-8d1b-4600-b8e7-97d0686a6338", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644362179, "uuid": "866b835e-7e74-4f30-96ac-8f4db86f9384", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644362179, "uuid": "98f034c5-eb96-417e-ae11-ed0d151219bd", "value": "tmpcdt9f1o6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3269806-8881-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644285091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285091, "uuid": "81d4e284-cf4e-4295-a32a-d21a1944f066", "comment": "Malware payload (RedLineStealer)", "value": "379cdc82ef22fe81e1bc771c0be5a44f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285091, "uuid": "c5cf9fd5-3fed-4c7d-9172-5425ab92aa7f", "comment": "Malware payload (RedLineStealer)", "value": "10ee7448925b23668a2804ca42ab6e5e5f29b0ffc88d76291ddcbce45db3cda5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285091, "uuid": "e306066a-f858-4ce0-a6b7-b7185851ed89", "comment": "Malware payload (RedLineStealer)", "value": "1e8c9f220041e59f21e5b8fcbdb38e97340815a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285091, "uuid": "f78717b8-a299-4769-89eb-82ca1616e5f5", "comment": "Malware payload (RedLineStealer)", "value": "99987d0090e64ca5aa9f0bd3f6e7d829f02112a4c7f9e768f7ef14fff5571457282c9978696431d30b050f2bc31edb42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285091, "uuid": "6b08d4f4-b41d-47aa-ba6a-44383c816e65", "value": "T166E3C7026E489B15C9BC343AD0FB2C3873A5F6CB03B1D91EDF0476676EC636699D8246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285091, "uuid": "75fed586-485b-48d8-9155-5c3b77d4dbc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285091, "uuid": "381fd2cd-ff34-449b-b526-62f773f76089", "value": "3072:OhtyCmRe9bq9TD1VEJKc9RBTOXdbcRDQMo:OhtybubtJd5TeUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644285091, "uuid": "d08ddcbb-b7a4-433f-a362-8725997c94db", "value": 152576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644285091, "uuid": "d7ed55af-1c6d-420a-ab58-4a7087576c9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285091, "uuid": "0e66bcfc-b7f1-42d2-9bd3-557f3eebfbeb", "value": "379cdc82ef22fe81e1bc771c0be5a44f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6779a83-8901-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644340099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340099, "uuid": "ce0a87af-1465-48c6-a45f-c003c000dab7", "comment": "Malware payload (Heodo)", "value": "b4786b153598b52c5b913cf961de58e6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340099, "uuid": "177f4295-bcc1-458b-ad76-7f0984702c6f", "comment": "Malware payload (Heodo)", "value": "1101945fc550096c79871c0cf88379d95e4ed4de76865e14a4c026273062ae2b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340099, "uuid": "2e4b9420-bb6d-4727-88ff-e8432a1bc77e", "comment": "Malware payload (Heodo)", "value": "d1b836baeca08af845475a5630fb21f47da5aef8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340099, "uuid": "cf365b56-bcf8-4b80-b6b8-b1380deabc95", "comment": "Malware payload (Heodo)", "value": "cbb6010e07949c10dd2aac9c73a07e6333a4fb9282efb0233c553bbe9912fc71408418d154623730ef47fc69eb61a4b8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340099, "uuid": "518e9e4e-0356-492a-abe6-14a6d5f07c60", "value": "T1FBC35A55F685EA1ADE0822350DDFC7F97336BC828E9A83473299B32F3D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340099, "uuid": "f26b3a91-7caf-4738-851b-835a9390053a", "value": "3072:TccKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dg+B2:AcKoSsxzNDZLDZjlbR868O8KlVH37ker", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644340099, "uuid": "b23ac250-82ac-4c59-8c5d-624497e45352", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644340099, "uuid": "fcdd7dfd-ff3e-4322-a675-2d24d9e65c0c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340099, "uuid": "2837bd48-2858-4a49-8bae-17a1448355b5", "value": "tmpyfv_zha_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99e16b3-8893-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644292967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644292967, "uuid": "48e9e3e8-fa0b-4b72-8d5f-87cbe5d8cc9c", "comment": "Malware payload (Heodo)", "value": "6e9512eee99a9928d6ce855f33423337", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644292967, "uuid": "7902c1ed-f085-4088-9136-5db3c19ea59a", "comment": "Malware payload (Heodo)", "value": "1138a7fc679ea8484ba6d386c34bdf28cb184228e9b29d3d384daefac1e0e2f4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644292967, "uuid": "7430b9bd-c39f-412f-9f4b-0febe86cd81d", "comment": "Malware payload (Heodo)", "value": "505bea5dfbe057c7951d79e3853368ef38fc34f0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644292967, "uuid": "eda5b795-5eb2-49ad-b5c9-b1648d4f8962", "comment": "Malware payload (Heodo)", "value": "c2fb8940c0eb2d138afc83c789d93fbb61eb841e96b8f5e72b3ee7090a29916cfed9120726e0dc476ef8ca520ef7f909", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644292967, "uuid": "326145e4-6069-422c-9970-2a5d52fb6c01", "value": "T18AD38D6ABA48CA0BD94953314EE7CBF67336BC819F5297473295B72F1C3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644292967, "uuid": "1fb4a9c3-80f1-4d4b-a1ce-901cd698ec4f", "value": "3072:gcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgDa3R:gcKoSsxzNDZLDZjlbR868O8KlVH3skec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644292967, "uuid": "48494e2f-01eb-4f22-b16f-f2fbd0a03457", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644292967, "uuid": "b7963cac-6263-4326-9c4f-5cddb4ae5640", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644292967, "uuid": "ba62e845-41e7-475c-9be5-1f2cf551832c", "value": "tmpxh5w_wt_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d81e3bba-88d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644322116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644322116, "uuid": "ca8fd780-f056-414c-988e-2a69378badbb", "comment": "Malware payload (Heodo)", "value": "1e29a22e2473ae3329635805045d3a78", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644322116, "uuid": "5a14c575-4aeb-44f2-be1e-f77e7dc11d96", "comment": "Malware payload (Heodo)", "value": "117a76f37e60ec4fd314882c8e3c8097cc00556b2d10cf9bd6139cb4e5328652", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644322116, "uuid": "269ddbe9-b441-4418-9eb4-3bfa89caae88", "comment": "Malware payload (Heodo)", "value": "90ae18254db7144cb2ac858b95aeb26da39a289c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644322116, "uuid": "0a681c92-43fb-4f7f-a691-1fda84c21ad9", "comment": "Malware payload (Heodo)", "value": "27f6f8f6909ba3a9dd8eb8f40c3346ca5eb7326200ccfbe4dea584c71dee85525ff866bc3dc2a5134e34246144271f70", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644322116, "uuid": "8e6d4e87-ea27-4bd3-a65b-e1ec8e7f5eb0", "value": "T1F1C36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644322116, "uuid": "df68ef4b-461f-4669-b20e-ed2af0eb8a8e", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644322116, "uuid": "450cc423-c76f-4102-8014-395fd16db22f", "value": 127764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644322116, "uuid": "81cd9ad1-33c0-4e19-ad24-c4b1d3417d89", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644322116, "uuid": "084dbfa1-3283-4eff-9484-66e3f150dd5a", "value": "tmpxjxlwu4g", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd170182-8894-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644293295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644293295, "uuid": "601bfeb8-a6af-4543-baaf-c9138064bf83", "comment": "Malware payload (Heodo)", "value": "0455068d5be8d44fa7ecff9a02418f24", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644293295, "uuid": "163d0d15-104e-4d9e-be1e-c66a0d1098ea", "comment": "Malware payload (Heodo)", "value": "11c944369c864e649f280e5450006905c3e88d37313cc1dc8f1134e6944666cc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644293295, "uuid": "5409f18a-117c-476e-9ed1-5b1492657627", "comment": "Malware payload (Heodo)", "value": "5ba169a7245487c6e732202a27676ce0d6bb6cd2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644293295, "uuid": "fd59dff6-9f99-42b9-9271-993825734b1b", "comment": "Malware payload (Heodo)", "value": "3bee526e950df554cd0cfcdbf09e8b22c91ab07a21984035643788c8338a2943c4036f196599eb49a8bf0246be296f24", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644293295, "uuid": "25abe72a-7725-4176-beae-5123a32dc907", "value": "T1BDD38D6ABA48CE0BD94913314EE7CBF67336BC819F5297473295B72E1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644293295, "uuid": "7ac3a665-7a5d-485e-bbff-1378e9bfdf07", "value": "3072:rcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3Z:rcKoSsxzNDZLDZjlbR868O8KlVH3skek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644293295, "uuid": "26c6dbc9-a0de-47f1-bfa6-b48382f157b8", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644293295, "uuid": "8aa35bc2-abff-46e8-ba27-d6072a39a4fe", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644293295, "uuid": "069a66e2-64e3-460a-a5eb-28096e260d4a", "value": "tmplb2uw9aw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6fa0745-88c1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644312665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312665, "uuid": "a5edd4a7-2f80-4a3e-8796-eed727ca966a", "comment": "Malware payload (Heodo)", "value": "d1bf607715633e2834f01c81c0f8aba7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312665, "uuid": "ac907e5c-27ed-4d9a-82e9-9c75a3befbbf", "comment": "Malware payload (Heodo)", "value": "11ca95e822e78d31d340659395a1d5b4d52f975d11404032bd06fdcee9c8cb1a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312665, "uuid": "8faa574e-33e4-4d7e-8809-607a6acc769c", "comment": "Malware payload (Heodo)", "value": "4d9616cc8e30d22b1c60f41a8078b0c9885e6a8b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312665, "uuid": "dbc7f0e5-1cc3-4357-a013-449626f04a94", "comment": "Malware payload (Heodo)", "value": "4c55385f6b0f988bd55aaf52cc10e5582f1c3e32524d21ce488c52f62ff5da513a089a9b0e170ac045d688822c2acd6b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312665, "uuid": "b7b102f8-f2a2-414f-bfe9-f2fcbd50d87f", "value": "T15293499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312665, "uuid": "1a2a683a-6dc8-4a9c-8bc9-e1555b71063d", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644312665, "uuid": "a720c3d3-dff5-4d0d-bb8f-3a7e972040bc", "value": 97328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644312665, "uuid": "7b453929-5821-486f-99ce-b0aaf28c0417", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312665, "uuid": "3fcd31dd-ca23-48a6-b311-51486ebb9192", "value": "tmpay4v5906", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14cedc7a-88a1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644298596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298596, "uuid": "56ecc411-4b82-47c8-9a92-ded3f361aefd", "comment": "Malware payload (Heodo)", "value": "ef88311a99dcccd619a659649a62154d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298596, "uuid": "2d876174-3699-474f-966d-ef8b5cefd2e6", "comment": "Malware payload (Heodo)", "value": "11f26cb97f1cff7db2fc2ab1d358c33a9889415987115ced405bdaba18e93577", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298596, "uuid": "2b7e41e8-5813-4185-bdf9-8d2b257fad3b", "comment": "Malware payload (Heodo)", "value": "b56732d1d58ab8649a26823c0abb94ef5b7bad3c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298596, "uuid": "5f5f82ad-8ab3-4a33-a403-f21f5dd55fb1", "comment": "Malware payload (Heodo)", "value": "1e9d33dd2521ba452c3f615c89a43791176fdf36bcbed13792b77595506fd70b0835a1962842893f594145279e5b93f9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644298596, "uuid": "70cc6a57-9d14-457a-bee6-f3190a8bc064", "value": "T111D38D6EBA48CA0BD94913314EE7CBF67336BC819F5297473295B72E1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644298596, "uuid": "baed8a89-f52d-477f-8eff-ccd8ca21987f", "value": "3072:mcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3l:mcKoSsxzNDZLDZjlbR868O8KlVH3ske4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644298596, "uuid": "9f9dc998-c59f-4cef-a117-bcf8d56b3b1f", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644298596, "uuid": "b2d614b6-2fa6-4fda-ab20-8b342a38ed0c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644298596, "uuid": "cd6efce4-59f2-483a-abb1-2c2240dcbd6b", "value": "tmppz3ohswl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461a8394-88a2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644299108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644299108, "uuid": "333e62ca-2ef5-4909-9ff4-d76408774d20", "comment": "Malware payload (Heodo)", "value": "d451c29bdd29a4302b12f5c26c89ce4f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644299108, "uuid": "7210a165-0954-49f8-8e4e-e76823ef3f6f", "comment": "Malware payload (Heodo)", "value": "123324705b468bd3ccd43f58c34bab9b178cc87c0ba60f57b3e4b43a6a1e8c16", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644299108, "uuid": "f6979773-c903-40c2-baa7-2b487082f788", "comment": "Malware payload (Heodo)", "value": "8c27642cd01907207d5e6df2768912eae56ba5df", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644299108, "uuid": "01467874-440a-4860-a14a-93b6056e61fd", "comment": "Malware payload (Heodo)", "value": "2a94285d4a2c50dde7b738a0949fdef1911dc60d70cccc600b80bd33d6c27c94ed7ec52defa05c0a44c2a9c60f04d407", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644299108, "uuid": "5af70de6-a2d8-47ae-9498-c9dce17f40c8", "value": "T1E2D38C6ABA48CA0BD94913314EE7CBF67336BC819F5297473295B72F1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644299108, "uuid": "3ac21c9f-9c91-420a-96c8-b7e153e55845", "value": "3072:vcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3z:vcKoSsxzNDZLDZjlbR868O8KlVH3skeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644299108, "uuid": "601b9009-4d8f-4e4a-a9ea-753a7be4aaa1", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644299108, "uuid": "06d9bacd-da14-4b28-b483-a23d3672910c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644299108, "uuid": "e97ea271-3c6d-459b-b049-c4c00a6fd271", "value": "tmpn8lexlxj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e3cb39-887c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644282872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282872, "uuid": "30173828-c167-4c4e-b222-b805705f5f8c", "comment": "Malware payload (Formbook)", "value": "bdee9442c6c00c66cae6a2966e21c959", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282872, "uuid": "594a9379-4dd6-4c46-90c0-d268ded667ec", "comment": "Malware payload (Formbook)", "value": "1299c1168e4958567314cc8109e37b20c5511002770554988a6fa25cb8e5aa4f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282872, "uuid": "8fcdffbc-7156-4e44-9917-fb43385f27a4", "comment": "Malware payload (Formbook)", "value": "10f51a298ab9bd1a20197593a5d45eeb62e52570", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282872, "uuid": "0140ff24-618e-4b65-9d8d-798c8d245476", "comment": "Malware payload (Formbook)", "value": "bbd1260a6abaa8a5b6d96164ba034bf2de322f719652f9818c92d945d66cfbe7e4832253972c49278688fd2dac07c33b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282872, "uuid": "41cc10d5-446d-4478-903e-91946419f979", "value": "T138140214FE7C3D41E9B25E7699FE4D0A2201DD3E0D7AD0DB5049798EA6B83A1DC302D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282872, "uuid": "fbfea699-69d1-485f-a80a-3dce4ad57e51", "value": "3072:N/xY7kMO1EiPTcImZyPONMT1QtEtkscVI/Ab1L/wWZH6WP5f7ifAQ1YO:WkPyiPTUZyGNAUWmTFZTf7ifAQ1YO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644282872, "uuid": "d6b7eb56-a586-4e6a-970f-7efa40a7e3d1", "value": 191624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644282872, "uuid": "3c817de4-9fc4-4a00-b25c-def192243b78", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282872, "uuid": "752431e2-4526-4216-81f7-15bdaf743bc8", "value": "documents.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df3697e-8901-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644339950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339950, "uuid": "965fcc72-8ed4-46cb-9236-3f3b2594f746", "comment": "Malware payload (SnakeKeylogger)", "value": "bd8f71e48d00a4e25f1cb01bba663fa2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339950, "uuid": "ea52bc92-5345-4bb2-9404-31180ea6bd76", "comment": "Malware payload (SnakeKeylogger)", "value": "12b104154284eb70c03c7a9797a3dc4594a43ea8a56e2d5985034d281182ad33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339950, "uuid": "c1fcedc2-3aa6-4b23-995a-bc474fdd72ee", "comment": "Malware payload (SnakeKeylogger)", "value": "a6c118c601fd80d9059543174df05cfe4645a138", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339950, "uuid": "50f97677-b1f1-4616-b1e0-188ad997f95d", "comment": "Malware payload (SnakeKeylogger)", "value": "838b467db1b5b49bf9fba1ec4d8de18706f2b52822332b6d7c7dc6b29489553971cf8a4e5dee2f5b3f92d818e2d93245", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339950, "uuid": "898f01ed-7947-4709-b4d6-8ac100c7e8d8", "value": "T1A2E49F687192A58FE407CD3188687C70967174E367CBCB23B257324DDE4EB99AF0419B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339950, "uuid": "e69f5b17-f274-4798-8de6-f95ab1deafa8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339950, "uuid": "b055f06b-4fe4-4b69-9fa2-76069f952abd", "value": "12288:PsCABdAplY4eHFHvWPl/SZu9wYORNeDLWA0nJXZ+XzQMVCEiG5+xtbCw3fIA04Es:VAU/yYIUCPADKbJXzMTVOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644339950, "uuid": "de997d9c-6eb9-4791-9391-c3b58f9057a8", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644339950, "uuid": "3b1ca5ef-c322-47c2-8294-19bf20d70117", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339950, "uuid": "e2c614e5-6795-4b76-ad42-84f06568ccc3", "value": "bd8f71e48d00a4e25f1cb01bba663fa2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba78e6b-891b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644351086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351086, "uuid": "6df07639-b12e-4a25-9ad3-8084d75604ab", "comment": "Malware payload (Heodo)", "value": "1f58550377db045d5b370002179ed505", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351086, "uuid": "efda296e-a343-4c73-845c-ebd648e0967d", "comment": "Malware payload (Heodo)", "value": "12c336d9cf025e374c753d4ea52e3083257d59df9e58cfd5740411c3830f62df", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351086, "uuid": "0187df91-98f0-4317-839d-4ff4759ad144", "comment": "Malware payload (Heodo)", "value": "f6ac51568e6bffbd2931c0c20e5d243a7674aa08", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351086, "uuid": "55df33b4-3993-4ac4-b0ae-e053f28a8169", "comment": "Malware payload (Heodo)", "value": "60cbe5d9bd34a5f961002e35b2e21809f3c4b72f3b3662fab74a63f4eccc41d72e99657cbab3daa31912f8c3464c1d73", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644351086, "uuid": "6981f3aa-d5ba-446f-ada3-ab301241cb29", "value": "T16FC35A55F685EA1ADE0823350DDFC7F9733ABC828E9683473289B32F7D76550CA12606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644351086, "uuid": "a4bdd0f8-e5ec-4d14-a6a3-9c7ea3677752", "value": "3072:pqcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBi:4cKoSsxzNDZLDZjlbR868O8KlVH37kea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644351086, "uuid": "371a003e-0d89-4754-8b60-26b7c54713a4", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644351086, "uuid": "627376a4-8a7a-41fb-a09e-0e551f05dea7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644351086, "uuid": "d5767402-0ca3-466e-a3b2-9d21c2459f0b", "value": "tmpwnjahdbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "782c53a7-8896-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644294038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294038, "uuid": "e7e3cc4a-2df9-46f3-a417-9b82d30aee84", "comment": "Malware payload (Heodo)", "value": "b6ac44a45f8352fe4e7d83a43d0466bd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294038, "uuid": "ce866ec0-2d56-4f6b-a9b7-9d58cccbcbef", "comment": "Malware payload (Heodo)", "value": "12c3b4dfa3dde1bca1f15d4117934b5d57c64a56cc90dd691d4eabf89a588a33", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294038, "uuid": "b1487121-0d7c-4f79-baf1-cfba5a28a3d7", "comment": "Malware payload (Heodo)", "value": "2306ac328119b145d11dbb72583618f20fcbd8eb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294038, "uuid": "9b1f988d-d8a8-468a-873c-27e25d1cc7bd", "comment": "Malware payload (Heodo)", "value": "f0990730c45f99855c84d8dd626e6cc0b5498177ff30c07b9240faefb94cb0eaa5229a91250bf4525b8f11bedbdb01c3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294038, "uuid": "683f3d9a-f321-4cd2-982f-573f9dcf24e3", "value": "T1D8D39D6ABA48CA0BD94953314EE7CBF67336BC819F5297473295B72F1C3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294038, "uuid": "dfc3886e-b78d-4c29-ae74-7e5a0a93dd10", "value": "3072:tcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa30:tcKoSsxzNDZLDZjlbR868O8KlVH3sket", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644294038, "uuid": "12d37402-7eee-4c5a-a0d1-9ca484536be2", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644294038, "uuid": "327b3f40-3441-45b7-91fa-2d1b704ef882", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294038, "uuid": "01cf6c12-c850-4092-bf90-2bda53f7e56e", "value": "tmpex03hygu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38964cf0-88b9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644308964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308964, "uuid": "53681c12-2261-4c11-bbb0-485a003c8d03", "comment": "Malware payload (Heodo)", "value": "8ab53335b704f761de24a106ac15827c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308964, "uuid": "72bc8e34-577a-4922-92bc-ec84f670c8da", "comment": "Malware payload (Heodo)", "value": "12f07f7739f3fbd74408ed35ea4e32b7bace8a7fda9d17d0d8839a076a05629d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308964, "uuid": "c5f69cd1-ccf9-4c9c-9b75-a5cc1e353dc2", "comment": "Malware payload (Heodo)", "value": "4a1dfa146d358f4c44b09197fdd168de1e57c881", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308964, "uuid": "663566b4-ec24-46cb-9c06-56ed9d051284", "comment": "Malware payload (Heodo)", "value": "383405135364bca492d5d978a14b9671910e98a5b76bd341e7b30508deb51a48cf13faab86c194623373476de9a5701a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308964, "uuid": "b29350ca-88d2-4d9a-944f-c6b24d7c8133", "value": "T1F793499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308964, "uuid": "ee0873b3-1d2a-4fad-b5a1-9efa5fb16327", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644308964, "uuid": "60ef48f5-6e5b-4679-a6b7-c45919fa6537", "value": 96400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644308964, "uuid": "94be0609-ae8a-4f82-aef1-1234a04ad762", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308964, "uuid": "50e51a49-ee84-4411-80ed-6aa126986936", "value": "tmp0h_si84z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42707dc1-88c4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644313705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644313705, "uuid": "4a95f702-9e96-459f-9d2e-a0d8d6611586", "comment": "Malware payload (Heodo)", "value": "b201f52372d6f4bc40ce3ef8869705e8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644313705, "uuid": "0fc83204-2742-4523-a253-c5777aec2974", "comment": "Malware payload (Heodo)", "value": "1302e71c427511250181724959be8b937ca2ca665980ad4e9c7ad937b9cf2d01", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644313705, "uuid": "5e8fd632-dcf1-453c-ae8c-3ae7870d7f5b", "comment": "Malware payload (Heodo)", "value": "a024b31e29cd6a94207c861c301ee73231db10b3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644313705, "uuid": "83b87b5f-412b-4e8f-affb-34a23fb2624c", "comment": "Malware payload (Heodo)", "value": "fd969803955949d6b8806081a5425a8c8a4475941a6bf8cc76e08fd15f0443ab8248c67c5ac40d39bc3ae739de397743", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644313705, "uuid": "a41c2a1d-8c79-4ec2-b96c-f0baaad9e4db", "value": "T1E2C36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644313705, "uuid": "084053ae-9a47-4096-bed0-736569c373a3", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644313705, "uuid": "d43dd35b-5b0a-4dfb-9d66-8a6239e88096", "value": 128064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644313705, "uuid": "72c139da-6728-4be7-9c73-71b9df174133", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644313705, "uuid": "171d03a8-6265-4126-8f7f-8b4699dae30f", "value": "tmp91vu6tws", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818425ef-88d4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644320682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320682, "uuid": "dc24ab89-fdb1-4568-b857-800dc1827e2f", "comment": "Malware payload (Heodo)", "value": "670af361c93b7cbde250c941258e97c8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320682, "uuid": "dff60913-af09-45ed-aafd-ad2185f47cf1", "comment": "Malware payload (Heodo)", "value": "130ffe03ef8335848352550c8ee73075d89cff90fd754e6589351346b9fb60f1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320682, "uuid": "3ccce074-1742-4764-a3a7-31abd21b8fa5", "comment": "Malware payload (Heodo)", "value": "ab2f9210b6bef3e23be5f5094d73e8cb05ac8c6f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320682, "uuid": "587b4060-7f55-4068-b354-9a0435081057", "comment": "Malware payload (Heodo)", "value": "9c18d781078a7ce61ee1c75744b8e68d0aba303862e0fc1c67ec247f8058dbdcd98135343df8acb2948e15ba575c9765", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320682, "uuid": "4c4ec1e5-7277-4119-be76-88a2784c70d8", "value": "T15FC43A12AA82B0F1C79C813EB3F97AEB903F146547AA76D34FB18C8965EC0D119F7911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320682, "uuid": "fbe8b45b-26b8-4581-9635-a1095037c551", "value": "1059dec3a72d4c311e39c8fc33d5af98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320682, "uuid": "5abeaaf8-489b-4084-9dc2-242cf8f699f0", "value": "6144:PQXvqLl4JINqB9QqbJq9AbuR/RzZ+fRLc96lnVPk5XtlOkiETHyROnR:oXvQDQVq9Ac5ZuRO6lRkzloEzyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644320682, "uuid": "2d3daadb-725f-4275-bb6c-ce905e012047", "value": 596992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644320682, "uuid": "618a0915-9b78-493a-81df-1ac8779981a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320682, "uuid": "846951fe-46a1-4fed-8241-b6e3e241d289", "value": "emotet_exe_e4_130ffe03ef8335848352550c8ee73075d89cff90fd754e6589351346b9fb60f1_2022-02-08__114432.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d38394a-88d5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644320970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320970, "uuid": "e87bdad8-ccd4-4134-89ba-7bcb462159f0", "comment": "Malware payload (Heodo)", "value": "f5a655c89172589f5bd7662ae933c8b8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320970, "uuid": "9ac17bf8-4188-4559-b577-50bd54a4ba75", "comment": "Malware payload (Heodo)", "value": "133627118ffa91befe37fb90cd06556fbe2af7872076848acb1b5cc8eee32a16", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320970, "uuid": "cf02fa3a-4b72-4afc-9a61-e63f11c13d81", "comment": "Malware payload (Heodo)", "value": "e361f206c0056fc932ea656ed2cbeccc330e79c0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320970, "uuid": "650e398e-a12d-4e68-b5c7-d17e199e6dae", "comment": "Malware payload (Heodo)", "value": "c5e44777ebdd87a1d95e846d57ddc69713a2be9954c0f174b7b7388f2e4471213e7f6b726f8ba80807dc60f212251795", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320970, "uuid": "311da3f1-3239-4088-b688-9c8d856bdd32", "value": "T1ABC36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320970, "uuid": "22ba22ba-9e12-4869-a24c-eb63805e4d58", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644320970, "uuid": "1a8b1842-0f79-4afc-be7f-a5fde14540dd", "value": 128389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644320970, "uuid": "72eaf16c-3169-4b32-ac23-bc9cfe974f45", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320970, "uuid": "fa87d368-380c-402f-9328-e1dbdc4ecebf", "value": "tmpby_pt222", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce1a64e-88fe-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644338660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338660, "uuid": "c530349e-a204-4fb9-809f-470d01689388", "comment": "Malware payload (AgentTesla)", "value": "0345cbd48c1f3953246a241b0b522d47", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338660, "uuid": "b49ddff4-89be-4ee4-9e88-2bc7abea56b3", "comment": "Malware payload (AgentTesla)", "value": "135e5088ddfa69ef5df95f892467f4611abbdcee724bc1d47bbb7600ceb263e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338660, "uuid": "2fbde151-6a9f-4a39-90c7-4b82266d932f", "comment": "Malware payload (AgentTesla)", "value": "c2bb7e2d8901f6258937afd47db72f685a992031", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338660, "uuid": "828861a3-7b0a-4346-bb0a-55cb704a17c2", "comment": "Malware payload (AgentTesla)", "value": "68eb867331b0acf5b7447c84f890fcea59a445296e778e9595f8f3f219f8b5225b2ed62226fd9f15433b36b98a91bd74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338660, "uuid": "4460fbe3-a89e-41a9-985c-395fa6c7f529", "value": "T134B4CF8F721C739FC65BCA72B9740C709610AF63130BD606B4D3EEAC591D69E9E121E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338660, "uuid": "79b07311-bbec-402c-97f4-62be9cb0aedb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338660, "uuid": "ec58fe50-a0e0-4cb6-a6fb-adf683b08c38", "value": "12288:T22JPYYsw2n4oSWV0D3xr4UPzB2YmljOdjYtpc0:TFJwYswjoRwBr4UPV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644338660, "uuid": "e0d7ed08-d4d1-4cfe-bf0d-3f6ca712f9a4", "value": 522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644338660, "uuid": "fa470005-d14e-4dd7-8ca1-4c8422ebffd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338660, "uuid": "cf84f98f-15ba-40bc-8c82-73d5783b90b5", "value": "IRS_FORM.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc7e7508-88f4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644334633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334633, "uuid": "8e509dee-2817-4198-b0c6-ead36ae3191b", "comment": "Malware payload (Heodo)", "value": "93882d40ec09e2ff9d26dba7bdeae3d5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334633, "uuid": "6a5fa0c6-210e-4517-ab04-24b1d30b2f76", "comment": "Malware payload (Heodo)", "value": "136b63979345e4285183c3b77aa2379dafa61611b5ad74da659ed5405d03fa72", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334633, "uuid": "8ec9cf9f-8fda-44af-a8a6-b8923e8c06ff", "comment": "Malware payload (Heodo)", "value": "49b13f53acfcd7489ac2768eb37d1a5ff05f21ee", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334633, "uuid": "9928dc7d-65ed-44ee-9ee4-a852a58f9f35", "comment": "Malware payload (Heodo)", "value": "a3d3c07bada9bd2d542df5511ee5474bc4d5a87b900dccf9674f891636b42ec56df80e32a5560152cd1c60053b793809", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334633, "uuid": "304b7d23-8325-4919-8851-4acc0339f907", "value": "T10BD38D6AB648CE0BD94953314EE7CBF67336BC819F5297473295B72E1C3A580CA03B16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334633, "uuid": "8abafd68-9c55-4457-8ce5-300e943e7499", "value": "3072:4cKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgFa3G:4cKoSsxzNDZLDZjlbR868O8KlVH3skeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644334633, "uuid": "cddf6134-0866-4453-9f3c-bf3eb5d478db", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644334633, "uuid": "38392b50-92eb-4af5-9cb9-38654e9fcecf", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334633, "uuid": "84714ed4-9891-4136-b016-e3352b750c7b", "value": "Open Access eBooks_5.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb235de-88f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644333804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644333804, "uuid": "7f9b6eb5-2885-49ba-ae59-03609d939429", "comment": "Malware payload (Heodo)", "value": "af74f12753408011ff5dd237dfdbf2f3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644333804, "uuid": "4673794c-c1c4-43f8-951d-f2eab6fac1e4", "comment": "Malware payload (Heodo)", "value": "1376007ceaf30828a171014de9a18098649621e7dfdb29e6ffe3bf6beceecda2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644333804, "uuid": "42ada877-b864-47bf-87b8-331da21cd5ea", "comment": "Malware payload (Heodo)", "value": "e49cb0433692cf3db204dd15639726d33669ace5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644333804, "uuid": "e803b403-62c5-41f7-824b-972ad2018dcb", "comment": "Malware payload (Heodo)", "value": "5a82ba3af910ac82a405e6e58de74a58a14673563492972d1dcf7e02fb537b08a771449c4644653bc9e6453dcf989254", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644333804, "uuid": "33e9f09e-a9f3-4d59-bfa1-5c95816bf042", "value": "T1C1C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473299B32F3D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644333804, "uuid": "a693463c-433a-400a-84c7-f738bd316fa9", "value": "3072:yVcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dg+BO:QcKoSsxzNDZLDZjlbR868O8KlVH37kej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644333804, "uuid": "ea2c68a0-32cb-4297-bfeb-157dcf2de2a5", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644333804, "uuid": "9c3b867f-9618-4bfb-82fb-85a72263b54b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644333804, "uuid": "30a3cec9-7fc0-4e5e-b8a0-b0df9cb3a879", "value": "tmpw1nhhvi2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83573a36-8923-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644354616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354616, "uuid": "0af59f9f-97c9-427e-8694-60b4a16a59f4", "comment": "Malware payload (Heodo)", "value": "05706e27efbc5bf0837cb85c29134143", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354616, "uuid": "24fbb422-db25-4ed0-ae33-01b70363349f", "comment": "Malware payload (Heodo)", "value": "13b201c9642cfdf35b18a60c195fd64379692e9cd10427ce7888e3be5960131d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354616, "uuid": "1e4cf4df-0d82-4003-a458-294e155199b7", "comment": "Malware payload (Heodo)", "value": "5f4f1a10211efbd428c4a726e23a3af18a703e72", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354616, "uuid": "2414bced-e3f6-47ce-b526-ae2050bb03b5", "comment": "Malware payload (Heodo)", "value": "1170fded3812ea223d1949527c209c1e7dcb7fc09df6493790cef43a744a55bee32548c2ea6d68ae50ce37b8caab3f19", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644354616, "uuid": "8c151f62-f586-42d3-a856-bcf143fc2613", "value": "T18EC35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644354616, "uuid": "cb257a9f-6fd7-48c4-a727-12ff0aac8290", "value": "3072:OfcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBv:OcKoSsxzNDZLDZjlbR868O8KlVH37keH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644354616, "uuid": "def5cd3f-75c7-4605-8f7f-178c74dce971", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644354616, "uuid": "c2df129b-40d1-4dba-8441-7a3cef224c69", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644354616, "uuid": "e12a61e7-deb3-44c5-9216-6b3823c4954a", "value": "tmpvbhxte3x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec72116-8902-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644340274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340274, "uuid": "8ee3717d-1ded-4bfe-9623-cfb3058a5184", "comment": "Malware payload (SnakeKeylogger)", "value": "a8444ec11d236653f27fbc32d55b843a", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340274, "uuid": "c5f03e7e-703d-4dbf-b934-8d61d02b5f7f", "comment": "Malware payload (SnakeKeylogger)", "value": "13c3c2c80f8f5740da1a8b83cc7141d9cbbf98482978789156a39d9aaba7d5bb", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340274, "uuid": "a2b9a863-a71e-4c35-9ca2-f257c0f3210e", "comment": "Malware payload (SnakeKeylogger)", "value": "9e7e58dd1f1b8bfba70464e3906dc5160509b71c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340274, "uuid": "a00d2af1-3c8c-4081-856b-01c9e21ab54f", "comment": "Malware payload (SnakeKeylogger)", "value": "c31178cb0eaa57ee537762fef2753eab597d55543aeb90e862ea08055a94f69872a8e1833c12ffd62303203b8df24f76", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340274, "uuid": "10d0808f-a57a-493d-92ad-417c7888cd47", "value": "T10955232293D4C937E6BC16FE2426F72002FCFEA4267FE2C51BD432A1153E395491699B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340274, "uuid": "a75f3482-d0ff-48e4-99c9-50b935cbe3c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340274, "uuid": "88c7d1c6-6af1-4cb0-85c9-7a63fc0781a0", "value": "24576:032zUzj4eb1oOq1lLFYXbk8Eh2UD4FJx2n5qg:ZgLSlL2/qiG5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644340274, "uuid": "f85c50a8-b275-4aa8-a682-6062cfade2ee", "value": 1295360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644340274, "uuid": "1af94011-3737-4332-9927-30a99e2e9227", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340274, "uuid": "4a087ad9-a958-44b3-accd-a7801aabe760", "value": "scan-arrival document DHL -pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7308656d-88a6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644300901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644300901, "uuid": "c4ac3a75-f0b0-489d-b134-24d3b58ffb05", "comment": "Malware payload (Heodo)", "value": "cbcf38981f212ec65262365340071667", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644300901, "uuid": "c263df0b-0f99-45dc-a176-5dc02a9abe7d", "comment": "Malware payload (Heodo)", "value": "13d3804211a3706a413f570b87a98e877b5aef74bcc526de70f6b0908ac6f7b9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644300901, "uuid": "ac4ff888-34ad-4e7e-9f7b-3df75d2fcc21", "comment": "Malware payload (Heodo)", "value": "d7a8f856bfd740342adeb375f2b2b66149f76fd5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644300901, "uuid": "096c46e5-f91c-4268-9343-4200cc98231c", "comment": "Malware payload (Heodo)", "value": "3c22534609c267f5e740f5d325b8c2e2d9c89b9e498ea9f6ecae27f767f0e311522c84eb2f7c35f431654aa6701ce374", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644300901, "uuid": "134f5df4-640f-47b1-baea-44abfa8834c9", "value": "T155D38D6ABA48CA0BD94913314EE7CBF67336BC819F5297473295B72E1C3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644300901, "uuid": "c2a41463-2c32-4df5-ba65-1728f020d20d", "value": "3072:wcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3/:wcKoSsxzNDZLDZjlbR868O8KlVH3skeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644300901, "uuid": "7fa94e1b-4c63-41a7-a235-a1f86b5676c1", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644300901, "uuid": "9f503263-401c-4034-8b52-69b3d24de747", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644300901, "uuid": "c085cdce-63e7-4d37-870f-82c4128e3ee2", "value": "tmphxhcce3w", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c44243b-88b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644305104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644305104, "uuid": "4e53adf7-0877-44ee-ac3b-749326938e9d", "comment": "Malware payload (Heodo)", "value": "fef96031052f1a094fcd5ef9877dbbf1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644305104, "uuid": "e514e42b-d0f6-425f-b78e-c1123815dd23", "comment": "Malware payload (Heodo)", "value": "13db03b234d53900a4a04e9c35b329c0d882e4efd2476cf3a2d6a524eda72c21", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644305104, "uuid": "ed979f46-4e6a-4af6-9dcb-1f884b158add", "comment": "Malware payload (Heodo)", "value": "6838accbd63661a836d5845e4cb36f1a917148f7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644305104, "uuid": "f81647d8-816a-46ec-ba5a-ff2324932ce8", "comment": "Malware payload (Heodo)", "value": "6c22c46744357b06df328866e08756e9d3e27de6126ac76bf12dead7be99f3af8e87c103314f6dd71de99d4ceb578265", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644305104, "uuid": "b4883945-c4d8-425c-b84a-c65970782e96", "value": "T18693499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644305104, "uuid": "d6563c84-06cc-4200-ba05-82b7d93323db", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644305104, "uuid": "68724a12-8b63-43e5-9c11-9faeba603cad", "value": 97011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644305104, "uuid": "4099ba26-5e79-475f-84b6-f2f9dfb2ffc8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644305104, "uuid": "5de90336-9701-45d7-8fcf-d93dd1f0565d", "value": "tmpx8_qkeae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "643da1eb-88cc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644317197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317197, "uuid": "692707a2-1034-4861-87dc-b68aed66573c", "comment": "Malware payload (Heodo)", "value": "328a765a2aad2a7c2331abf95ba19b13", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317197, "uuid": "b5438d0a-3852-4895-bc47-3121f41d72d1", "comment": "Malware payload (Heodo)", "value": "140788ed51d6ff8b24af141db3fd8890c01993b59d5993292f9678399fa3c4e1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317197, "uuid": "8fce9365-f805-4b84-9c83-65b38e28dfaa", "comment": "Malware payload (Heodo)", "value": "06e9b8f4d34a713f6b59e7273adba185b249e72b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317197, "uuid": "dc4153bf-bce4-455e-a37d-e7c7015e97ae", "comment": "Malware payload (Heodo)", "value": "ca2e15fd4eee58ed4f251572267f952bc0c8a4f243365ba10d032ef2f2f05f7f17bb8df352e8d91779e5509eb8841840", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317197, "uuid": "c79f5aef-93b0-4e64-b078-c466d6a9e318", "value": "T1C993499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317197, "uuid": "baf419fc-be49-4a60-ba34-d387eee9e19a", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644317197, "uuid": "60b71fd7-37ed-415a-8163-d784252fe93c", "value": 96552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644317197, "uuid": "998b972b-97ed-4070-bd16-070199e43ef1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317197, "uuid": "140ede8d-0b88-4cf8-a3b2-4f3b6e0f5370", "value": "tmp93ck56s5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a0d8df-892f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644359797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644359797, "uuid": "d308fa10-0b7f-4159-bfaa-2c59c477a278", "comment": "Malware payload", "value": "bf15921a6a88668a6185dba938644f21", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644359797, "uuid": "8150b920-7e5d-46cd-9fe0-e03331672937", "comment": "Malware payload", "value": "147f97accdb9fcec4b061434f5952bc92540ff953a5369fde0ee9067d9988bfc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644359797, "uuid": "cfcbcb3d-0e0e-4e2d-8ba0-3853af8302ed", "comment": "Malware payload", "value": "e2079e97e317c0ffed33baa17e2cdb3d6ebc9d76", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644359797, "uuid": "11373537-5cf2-48eb-9597-7e893637a568", "comment": "Malware payload", "value": "e63d233d483b1cf2e6a3424012f08b79ac744435c8af26f0e918fd418e2b0d0f022e58320fdf5c13c87e019a2e5fa0bb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644359797, "uuid": "77248c04-6f2d-4664-a5af-d6dbc7abf609", "value": "T1DFC35A55F685EA1ADA0823350DDFC7F9733ABC828E9683473299B32F7C76550CA12606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644359797, "uuid": "eec72942-97bd-40b6-896b-8fe6de08a0a9", "value": "3072:iWcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBz:bcKoSsxzNDZLDZjlbR868O8KlVH37keb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644359797, "uuid": "e3dfa9bb-a3b2-4f55-a02c-17f201dbb72b", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644359797, "uuid": "e6d2acd4-3945-4c41-b563-96ea1545122b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644359797, "uuid": "464f76ed-e8dc-4242-893e-25f226eefcb0", "value": "tmpurw011yg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e05a6fe-8879-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644281404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281404, "uuid": "05ae54ca-6a5a-4202-a21c-a1dde4434058", "comment": "Malware payload (Mirai)", "value": "cdd2543e125a6766e92615fb4d737729", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281404, "uuid": "cd4d5722-3057-48f8-94e2-47f7a1c63773", "comment": "Malware payload (Mirai)", "value": "14dcfec24a02117c06a42388fcd1052828cb1caebd41e1830e5b372780329edb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281404, "uuid": "64b97e82-0c90-4cfc-9acd-d9010afe3cf1", "comment": "Malware payload (Mirai)", "value": "e3aea9f82e3b52c8252441a29851a1ed6849968a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281404, "uuid": "e4ac83f4-1a5e-46e9-a5b0-92457f0a4b21", "comment": "Malware payload (Mirai)", "value": "ff76f0c9052e27f880fe0343825ef918f68ea8f73cb6bbb8df372e77ff35a73d92a28596713bb5420767bdbe4aab2c84", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644281404, "uuid": "26e06dfe-c068-494f-8327-f4e6c8f17c0f", "value": "T1D4536C51F8919A23C5D013BBFA6E568C3B2553E8D2DE32039E352F613BCA91B1D27E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644281404, "uuid": "f3bb1350-4712-4a93-bb9c-b5719eb1e2ab", "value": "1536:s2txiBW0T/Y1279VvoUhWk3G5GIp86ia10e:s2Pi8v+PvoU0+G5GW8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644281404, "uuid": "24b90fdc-2a96-491e-8832-b59e1433f18e", "value": 63860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644281404, "uuid": "66271853-1689-438c-9915-e53f8b29747b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644281404, "uuid": "f5b7e3c6-0b72-4085-b1bb-ba0ce77194bc", "value": "jKira.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec18791-8874-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644279419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644279419, "uuid": "813cb113-a7d7-4854-97f3-1fbbb1fb290c", "comment": "Malware payload (Heodo)", "value": "0e71e8b8da5a10609392263b0f74f026", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644279419, "uuid": "6feaba89-b004-48ea-ac66-3d64049dfd5c", "comment": "Malware payload (Heodo)", "value": "14ec684c8a2e63fc85ba3093d50a498020cdfbfe544f938e90c8f12deb73c372", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644279419, "uuid": "87d9464e-2a19-4d5b-963a-f22c76f179a8", "comment": "Malware payload (Heodo)", "value": "1f6b8ba96bc1faae9eb7cac1a55011cef94818e2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644279419, "uuid": "782fef91-e76f-4a57-ab7a-659a1f39a605", "comment": "Malware payload (Heodo)", "value": "e0934353db388e90c610f0a3994a12682db6d2a7d2e5c8c763e5c9171a9d418894fc4824aeaf395d215537b028b6a9ed", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644279419, "uuid": "03a5769e-dec8-4e68-96cc-a8f173802cd9", "value": "T187D38D6ABA48CA0BD94953314EE7CBF67336BC819F5297473295B72F1C3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644279419, "uuid": "f88faf11-ca57-4de4-a599-ab828e15442f", "value": "3072:kcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgDa30:kcKoSsxzNDZLDZjlbR868O8KlVH3skeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644279419, "uuid": "c6ef4eb6-766f-4585-a6e0-2d735120240e", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644279419, "uuid": "320ec4a2-2160-4447-9d0f-ada4baefdd6a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644279419, "uuid": "22408d21-6fa1-4403-921e-4f6ce1fe6c62", "value": "tmpxpktuos8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1eba6a-88b3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644306720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306720, "uuid": "2b5cc528-2f70-47d8-a40e-f30d90ae2e53", "comment": "Malware payload (Heodo)", "value": "37d78721efd02f1a0586a269854e7049", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306720, "uuid": "dbaf9fd2-3f19-4666-8f08-79dfafacd66c", "comment": "Malware payload (Heodo)", "value": "150997e839d601212bd3cb1109fbd5794016bd172b0d0980258c8b548921b8a9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306720, "uuid": "4ee23829-13e7-41ed-9032-2d5dfa396608", "comment": "Malware payload (Heodo)", "value": "6eb640ef1ddd37ea4471883be06af18adccc7fe2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306720, "uuid": "0247b7da-5f1f-4349-b928-61502691c020", "comment": "Malware payload (Heodo)", "value": "fbf31cf125b015c042794d5a72b8327e82b2c0910110ad987bd4b1a441f0464e4b1d12d2e804c4003ed5706c2ce430b3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644306720, "uuid": "31f5f912-eaee-4cbd-abf0-f1c2b1f1ae2c", "value": "T17993499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644306720, "uuid": "97e28136-a7d5-4f38-8319-5801d39f9f68", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644306720, "uuid": "949069c0-1760-4410-a119-db216cbcccff", "value": 96580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644306720, "uuid": "7ce38e46-2920-4faf-9807-aae7e4adbab5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644306720, "uuid": "4d779040-62ec-4a8b-bd61-6d16eccedc6f", "value": "tmpa1rghcl4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dcf4021-88c1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644312382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312382, "uuid": "57b532d6-49bf-4b27-ac07-382ebedc3388", "comment": "Malware payload (Heodo)", "value": "2d4691afda8a6f28e73996441b914ec2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312382, "uuid": "51fa53fb-6301-4107-aae4-8eac5fc39a3a", "comment": "Malware payload (Heodo)", "value": "151bf2dfd3fc4d8ae0d84420cce91e2dfd6be3b0cb8ae83dc0fd9764acadca36", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312382, "uuid": "b0657e7d-b907-4108-a6d6-f5f5b3f52493", "comment": "Malware payload (Heodo)", "value": "e055caa2945f7ad3ac87d403345f917ad2aadef5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312382, "uuid": "8b43f342-d16d-4d13-9502-198fbd12a5fe", "comment": "Malware payload (Heodo)", "value": "7b6853222109d47fec7cc2d2b82e0a13a5371bfe872ec59f1feb437bdf62a5e9dad37f33086c18381b22a807da925c38", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312382, "uuid": "77fb8213-ca11-4326-a247-b4d5aa1b0b2f", "value": "T10393499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312382, "uuid": "cdc4bd59-c2f5-4210-a674-d60d9da54bd1", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644312382, "uuid": "88777e21-dd0c-4e68-80b4-cffefc512319", "value": 96285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644312382, "uuid": "267c7d91-4468-4855-a534-18e9ca0b6550", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312382, "uuid": "98e9a7d9-acfe-44e1-b5ce-42a04befe068", "value": "tmp40srwe76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3487374-8904-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644341382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341382, "uuid": "3a8d6743-00f9-4e1f-af10-c0fecad84cdb", "comment": "Malware payload", "value": "019e6e6d55f1b1d1f884e13491d37170", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341382, "uuid": "9f6adfb1-995e-46b1-9776-84bb73ca13af", "comment": "Malware payload", "value": "153a5a770e7594794ce3ac19121c1ad44edc6acdf4e4ae6d77adbd964ae6609e", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341382, "uuid": "0d86210d-800f-49e3-94e6-9c46ca3151ae", "comment": "Malware payload", "value": "463447cebcc99f38def02e4f18b39d9a6f6443de", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341382, "uuid": "8472fe61-1877-45af-b3ee-5bf8ae8c5e47", "comment": "Malware payload", "value": "dacffa5fc292e6d121667097283d11a1aac26f001bd73440b3a0d9eaa7cb33b8d0940b7027fbcdabd14307afa3d156db", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341382, "uuid": "5bbb8f44-fe07-42b3-99ea-af47c9db745c", "value": "T1A2C49E2172DAC936C87F06B06D3EC79A4669BD6447F2C4EB13C86D1E0DB39C15232E96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341382, "uuid": "b0c5f399-1b41-4681-9c5c-76ea95705fb0", "value": "12288:PQ5bhfYBowv43bqKlRH1Vq9iyX7AbTMTN:45bZYBowvitjVqoA7AbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644341382, "uuid": "3a955cb7-0ad6-4126-9c33-5c8c96d9ee23", "value": 576000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644341382, "uuid": "6292bb35-af86-4c3f-bf71-79c9aa94012f", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341382, "uuid": "30713740-02ee-4970-ba13-f0a5dfa21df8", "value": "NFE_6337.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5434082-8937-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644363316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644363316, "uuid": "356ca9f6-abb1-4411-b429-8d0a42103ec6", "comment": "Malware payload", "value": "5c2577c9b5d6c3f9414ecc9c2f1352a9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644363316, "uuid": "cb6dd8f1-207a-4f15-8d3b-18cf230f84e6", "comment": "Malware payload", "value": "1545b3a8a5fe6dcec960272eb37c48ebeef396f36229adb511915f86c70089dd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644363316, "uuid": "e78c5d43-24fa-4abf-ab93-6947bb951db3", "comment": "Malware payload", "value": "d613182d3bc3855ca5bde9e045329d0d579066b8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644363316, "uuid": "8b57a60c-1c09-4f3a-8fc3-260ccebcd7f4", "comment": "Malware payload", "value": "cb066f1c1ef1db42afceeee058e4151a87815c91351f0135b7fd4b5854aea438a94ae3083f38744accb771c91d800415", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644363316, "uuid": "0e1cb581-5a0d-47ff-8d1e-1975c15e5528", "value": "T1CCC35A55F685EA1ADE0822310DDFC7F97336BC828E9A83473289B32F3D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644363316, "uuid": "ce4c62e3-769a-47ad-a4b1-3bcfe46f1e5d", "value": "3072:CacKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgiBj:DcKoSsxzNDZLDZjlbR868O8KlVH37keq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644363316, "uuid": "49356bd2-3c53-4e95-8717-dd78685347bc", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644363316, "uuid": "14ca54f9-3f0f-4c4d-8bfe-71cd34f57319", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644363316, "uuid": "dbc9e190-020d-49e8-a137-07637ad49f94", "value": "tmpwdj78fg5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e98f0cd-890f-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644346071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346071, "uuid": "c39ebd79-5ee2-451d-8afe-234ae672f2ad", "comment": "Malware payload (Formbook)", "value": "cbf5cf49954e3eaab9111ff4e3489148", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346071, "uuid": "4c691472-8189-4b81-845f-7507b6f18b76", "comment": "Malware payload (Formbook)", "value": "1575198d7ad60f56d2a14359f82de8b6d0a5fc3278c1b6dc55716b17873ab54f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346071, "uuid": "debd31f3-c2fa-4509-9232-5909c9b49f70", "comment": "Malware payload (Formbook)", "value": "7c8a7b42dea1dec8599d5953ce88008f3dfc6aa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346071, "uuid": "48310caa-6a2a-4c64-9c8d-55dcc0885611", "comment": "Malware payload (Formbook)", "value": "ece1b49cc5d086e9b28518ebe934fd60a97b77b5d2b2098aea7ae85e9fddd65d715d7dfd92b11ccd17860c380fdcb2cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644346071, "uuid": "9b403b6d-758d-4d47-8f4c-98e42918b0e7", "value": "T120B47B2F48BE113AC6FCCB7098D0CE1FF866D5563977692D269225D809232F275D222F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644346071, "uuid": "7688e174-a21f-4101-838e-106d77c63609", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644346071, "uuid": "5186151b-bfb7-4d0e-b611-c494a5b81b05", "value": "12288:/EXJrJT8LH6BuvZnjY72pbYYEtpGB5Tv:/IG+cpY2pbYdpGB5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644346071, "uuid": "c05dcfec-92c4-4018-a452-692199f0f30d", "value": 518656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644346071, "uuid": "d05207ea-07f4-447d-8dd8-3ade8ef4dba5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644346071, "uuid": "a62f6be5-6e21-44c1-9993-0016409dbf89", "value": "cbf5cf49954e3eaab9111ff4e3489148.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "989cfd79-8892-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644292374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644292374, "uuid": "38565f7e-62b5-40b4-b3ea-a38e5fcf81b0", "comment": "Malware payload (Heodo)", "value": "4ec559fbb584c2b8ca93b808bab3075e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644292374, "uuid": "fc54259d-1cfd-4d70-9498-d815e0214cc2", "comment": "Malware payload (Heodo)", "value": "157521ccbf875b4cbd76dcc8bc8615ba6f1dc47db297fbc343c73941729b7d03", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644292374, "uuid": "34ed7ed1-b568-471b-8af5-4899dd47bf0a", "comment": "Malware payload (Heodo)", "value": "ed9409f4e63a5e21377dd545e40c0e0db013fde0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644292374, "uuid": "6825195b-3660-4f03-8c6e-4e78da7037b8", "comment": "Malware payload (Heodo)", "value": "1cf464106bd4b92394fd3cd17c8e10f62a29b44504d4251c8282fb4a82f68d08590fa8165c62d36e274c8ce4b256e7c5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644292374, "uuid": "5da025f5-867a-4f40-9ea6-85eb9a15b485", "value": "T116D38D6ABA48CA0BD94913314EE7CBF67335BC819F5297473295B72F1C3A590CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644292374, "uuid": "d33b9d3e-e5ec-4bd1-ba46-64598a30c170", "value": "3072:FcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3t:FcKoSsxzNDZLDZjlbR868O8KlVH3skeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644292374, "uuid": "75431e51-064c-43d3-8b2a-00c47ea487a7", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644292374, "uuid": "5a42149f-a7a5-4e5c-9505-e747d9ed288c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644292374, "uuid": "e4260026-926e-4e34-8a1c-0dc0487d5e3e", "value": "tmpzfmcc_xx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edfcc3aa-890f-11ec-9275-42010a9c0029", "comment": "Malware payload (BitRAT)", "timestamp": 1644346205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346205, "uuid": "e3eb6e03-38e1-4e4e-91f1-880074378159", "comment": "Malware payload (BitRAT)", "value": "0ec5d93fececef7f0089ff2e60cd156d", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346205, "uuid": "4ac248d2-5408-40dd-b88c-184a9e30bc49", "comment": "Malware payload (BitRAT)", "value": "15a0568ab785cc4bb8196a0945f1085927470242eb93f28b8a2878408112e71a", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346205, "uuid": "413d82ae-46f3-4c4e-881b-2ae4ae46b015", "comment": "Malware payload (BitRAT)", "value": "d8440d852bdad55314f4eaecc606393bd79d7903", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346205, "uuid": "0a2d2cfa-a2ec-45c8-812c-5feab8eaa999", "comment": "Malware payload (BitRAT)", "value": "7e66f71172e509309d51371cfbecb64d8ac6e0bf17bd77f9f06f0c2b6889e4d612f9eccfaa61f922cdc93f7cdc64f1ca", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644346205, "uuid": "7ae2d5b4-873b-4614-a74b-ff274c9079c1", "value": "T17CD5232267B46028EBB71EB10C3B60551D763C055D78CC4F22899F3E4A72A47E9B5B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644346205, "uuid": "992ae677-39c2-4897-a658-feb6d26e118b", "value": "baa831531f59211307b78efbc48da94c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644346205, "uuid": "1e4709f5-0b90-4d16-ac3e-a9918cb12ca5", "value": "49152:QILj+imzAbT10Rmo7RXMukn4Pm96gxoTk9OfYKk6KWegvpX7HkfSqr:jLCimcT1omWSuKYm9PII4JKpgvprw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644346205, "uuid": "713a2426-3637-42f2-a9f7-a0db5a72c0cd", "value": 3011071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644346205, "uuid": "30059fc8-7404-412b-a9cd-d763cc82ef73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644346205, "uuid": "8c510088-a537-488d-b664-450151e1d555", "value": "0ec5d93fececef7f0089ff2e60cd156d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da54ab3f-88c2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644313100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644313100, "uuid": "77a99416-832f-4a16-bd8d-f3b9963f31ca", "comment": "Malware payload", "value": "742dd6bd90d238216c09c51b28ed1ba1", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644313100, "uuid": "842d0735-bdd3-40f9-8e8d-e8ca590d5770", "comment": "Malware payload", "value": "15b23ef5cea995b57ecdd915f0204d96c8ba8aa051a588f06b364f0a08e69908", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644313100, "uuid": "56ebb5b5-16b4-4d6a-ba58-603a6ad73674", "comment": "Malware payload", "value": "e5be0573197842fa273031cbb99f5d00c9b3a7a3", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644313100, "uuid": "f4ccca2d-138d-4fb0-91d7-ef89949c7db6", "comment": "Malware payload", "value": "f096b5c20ada6e29c8a6421fa6a89c3dba2e2efc4b5e938e1e7194034dbf127073e483cd696cb83da0c95262ef73d043", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644313100, "uuid": "798c6791-4308-4b82-8bef-d43440e8183d", "value": "T12114124338F688E6DD5BC5FC19B370B6FA2CBD4A0F4938571214B6653A34692322D376", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644313100, "uuid": "3705969d-d512-4442-b303-1a7659e443e5", "value": "3072:YWyXViD9EilTbKk8IT5H67LwYcqMNJyKZmVgSua5Ksh2VUTY3fblI4K8MGA1COpt:ZD9EitbKkn5iUVq8BZmW2QMJTY3zLhYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644313100, "uuid": "9b1aead8-5277-4b24-99fe-86776478cdd5", "value": 191336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644313100, "uuid": "1d4651be-c119-4a05-9ba1-814644c03dec", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644313100, "uuid": "bcc7166a-3c1a-4bd1-8184-c583851c95a8", "value": "PurchaseXOrder.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b97eb1-88c5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644314301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644314301, "uuid": "03f309cf-a3f5-40fb-b21b-36a648deafc2", "comment": "Malware payload (Heodo)", "value": "4cbd7ab9440b9c7a17f6d7f801430d3a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644314301, "uuid": "47d12800-755f-4868-95bc-86a4964d20c2", "comment": "Malware payload (Heodo)", "value": "15b580dc10be803aafa2156ef3b8bc34b20fbbfe9a53e464e39f0fca2e831d2b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644314301, "uuid": "94166bb7-4828-466c-9485-1ea784507158", "comment": "Malware payload (Heodo)", "value": "777fe78f957031c940c747d3cf814f97caee7d22", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644314301, "uuid": "ef236bfa-9489-4622-bc88-cb1017330189", "comment": "Malware payload (Heodo)", "value": "0b9404587d1787cce70e167be04d2d206edf3f7ff36831afe2375cda8014ad416885a0516e4e13526f045d96ddcf7c29", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644314301, "uuid": "8d52d9f6-a65d-4440-9178-42c18a8fee20", "value": "T18693499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644314301, "uuid": "e0d3aa9d-92e9-4a7d-91be-418f540c476e", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644314301, "uuid": "f10b7611-312b-4280-9187-32cc2034fa0a", "value": 97138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644314301, "uuid": "b569adac-352f-4dd4-9ef1-c3188bc4c36e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644314301, "uuid": "da683280-f2cd-465d-86b6-a55198a665a6", "value": "tmpdrqqv7rv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4794d673-88ec-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644330893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330893, "uuid": "56671d23-60d3-489f-b804-7eb87459d660", "comment": "Malware payload (Heodo)", "value": "fda6c74e7af7e0cc97162e45b42c207e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330893, "uuid": "561fba7e-377a-471f-9e8e-de098c822df5", "comment": "Malware payload (Heodo)", "value": "15b9ed4f53891434aa211b87f99f17c5882c7ed51e80946ca29f61b61c65c03b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330893, "uuid": "c03c163b-0965-43a1-970c-f291b0aa4bc3", "comment": "Malware payload (Heodo)", "value": "58028a0b90f62d65b14508958b8977670399b0bd", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330893, "uuid": "2b367050-1dd0-42e7-aae0-105a52c0d071", "comment": "Malware payload (Heodo)", "value": "3de88d9a98cad3d76dd226481161f0dddcf4d3854811d2fd199aea4fefc8daf44153109e77f44ce93ec6f1b7219d8ca9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330893, "uuid": "14ce5189-d610-4f28-ab8a-9da2c6ee91de", "value": "T1A2C35A55F685EA1ADE0822350DDFC7F9333ABC828E9683473299B32F7C76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330893, "uuid": "5bd26f78-262c-4e55-ab01-1d62ebf3be50", "value": "3072:SXcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgcBt:icKoSsxzNDZLDZjlbR868O8KlVH37keq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644330893, "uuid": "8f0cbaac-7715-432f-a851-9ecfdd3b5921", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644330893, "uuid": "48eed15d-e1fb-4f9a-820f-337ab176149d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330893, "uuid": "f4b3293a-1d4e-4be3-a103-43237bb17c2c", "value": "tmp07t8h62p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef41293c-891b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644351361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351361, "uuid": "6464b81d-8987-4f69-ba45-417e6d975260", "comment": "Malware payload (Heodo)", "value": "134196d074e0c9d13f420dfc0e2ac23b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351361, "uuid": "a3f92555-033c-4302-bc6d-d216f623f7fa", "comment": "Malware payload (Heodo)", "value": "15c3579226a0e7c179f2eacff489e0c2f9b11dc728361f11c8392a8fb5badb11", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351361, "uuid": "5300ceee-c53a-4902-952e-edf520aa798f", "comment": "Malware payload (Heodo)", "value": "e5502761884245dab265402c80e798b0f125864c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351361, "uuid": "80594037-280e-439b-b5b8-7e87195a9e2c", "comment": "Malware payload (Heodo)", "value": "dc51f6f09e65784a021d7291b79890544e07822608e2ab8e8bdb946db3b3f4d0baeb600892bff6b9d28b48066999ecd9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644351361, "uuid": "e87ea51a-f561-414d-94c0-e4be4892e03f", "value": "T19CC35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473259B32F3D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644351361, "uuid": "d215ba89-c515-4085-83ae-1f819e5e3a5d", "value": "3072:ZXcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgiBw:1cKoSsxzNDZLDZjlbR868O8KlVH37ke9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644351361, "uuid": "97393ba3-e549-419d-a502-110b8bcaff68", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644351361, "uuid": "0c17570f-8d44-40e9-ae8b-64c69480ff72", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644351361, "uuid": "fbdc20ed-83db-4f70-8763-c64aee499fd2", "value": "tmp8gi9tb1n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc479bab-8921-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644353960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644353960, "uuid": "7ce6320c-e3d1-4a4c-9bef-a2e0caaa93b6", "comment": "Malware payload (Heodo)", "value": "a303ee57cca90b2ac20d44aa2e56fc0f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644353960, "uuid": "2630e2ca-9b34-499c-a119-5e4c35275699", "comment": "Malware payload (Heodo)", "value": "1668a792f51bf5937422781eda0e683d9a15e1fe6ff395f605b518b0c1de09e7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644353960, "uuid": "6451fe23-3adf-4fa5-a957-ba72d556bbed", "comment": "Malware payload (Heodo)", "value": "39fe02b23be1a09c2b7114ba7981387da5a5c53d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644353960, "uuid": "b088bd79-e033-4b26-b330-8d023f9095c2", "comment": "Malware payload (Heodo)", "value": "c02ddaaed881eaf81c10654d1a8b574bc9a166923b5ae66da52e232abb0984810b9d6fb3b216c606b6a8db7277972b50", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644353960, "uuid": "60b53fc5-3d0f-4d27-9925-2765e1fe6977", "value": "T123C35A55F685EA1ADE0822350DDFCBF97336BC828E9A83473289B31F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644353960, "uuid": "9c8005f3-2432-4fb7-a748-336fb2806d99", "value": "3072:U+cKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfB5:FcKoSsxzNDZLDZjlbR868O8KlVH37keB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644353960, "uuid": "e5bda088-039f-4ce7-bcee-e5f8c9c1f8ba", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644353960, "uuid": "9ff56747-951a-4479-a555-5c83c44fda53", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644353960, "uuid": "9ccdfdbd-1660-4009-8f62-3c3c5b7a83fd", "value": "tmpvdivgpe6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "191ef2c7-88a4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644299891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644299891, "uuid": "8884583e-78a0-4cc2-95ee-472af2bca415", "comment": "Malware payload (Heodo)", "value": "66997ef4b2247d6857b120f22a2a5573", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644299891, "uuid": "1b138c1e-471a-4d28-bf47-29c05ba21a4d", "comment": "Malware payload (Heodo)", "value": "1690a8507bb7d6d1b8e633ec459a3e6ea0f231fc071d382a5a1407d9c84e7def", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644299891, "uuid": "7c3ddef2-6ad1-4007-9a4f-b15184463811", "comment": "Malware payload (Heodo)", "value": "8c5c0df07ba053c1bacd8d890b8f4a1165ae5489", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644299891, "uuid": "fedcbd6c-f4fb-4f7c-a17a-f492fdb66757", "comment": "Malware payload (Heodo)", "value": "e7d8a0bed6af0f3646e6b8533f13a0ba6419b8e15372eb1a61b11a3ba14e480d67a8e3786e638fb05a5f89e4bde38994", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644299891, "uuid": "6b8efdec-6e00-41d1-92b9-e34ef5eb3769", "value": "T12ED38D6ABA48CA0BDA4953314EE7CBF67335BC819F5297473295B72F1C3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644299891, "uuid": "e866916e-5d9c-439a-ba41-dc562550af31", "value": "3072:VcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3A:VcKoSsxzNDZLDZjlbR868O8KlVH3skeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644299891, "uuid": "2209b4a7-5df1-46ec-ab35-6fdc053d55b4", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644299891, "uuid": "df1af61c-6f63-4e73-9509-16986b5f1ee9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644299891, "uuid": "584c4703-c50f-4f3e-a224-ac18df091d51", "value": "tmp6kyehybh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a5389f-88ee-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644331967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644331967, "uuid": "3714aa74-9cd6-44a0-84f7-2a4fb24cf742", "comment": "Malware payload (Heodo)", "value": "68a96e19c16c8183d2e523460f0987da", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644331967, "uuid": "bf6e405a-cbf9-47f8-a3d2-f7a00981d22f", "comment": "Malware payload (Heodo)", "value": "16ad31ba59aa34dc9ab9f4065a2e928135c3f49189fb1b118c91ea93195c6d2b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644331967, "uuid": "4b7b5ac7-a42b-4a2b-a38f-2aa350a26aed", "comment": "Malware payload (Heodo)", "value": "056fc12c5e9a1809ddf5266b09563b6c668aebe8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644331967, "uuid": "fe3e005b-3e2e-4371-82d0-b6e4bcda3f06", "comment": "Malware payload (Heodo)", "value": "6dccba38efbd3ead3d963bcd46a6adb7ddd10ecfd0392d4646abb66097e0b14d107dabc0ed369faa3a8594a2b5d3c3a3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644331967, "uuid": "ba1a9524-7d66-4259-85b2-87648ba804a0", "value": "T191C35A55F685EA1ADA0823350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644331967, "uuid": "826c130e-d250-49f7-a999-826617372b38", "value": "3072:RlcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBD:zcKoSsxzNDZLDZjlbR868O8KlVH37ke7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644331967, "uuid": "794fdc50-3679-4434-a72c-6afd7e60eb84", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644331967, "uuid": "cfeaf8f5-4d94-4393-b640-2ed5b91b252d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644331967, "uuid": "6c08cf38-85c8-407b-8907-7f71375d34a0", "value": "tmppd2d8r36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2144a0-88ca-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644316456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644316456, "uuid": "065c8a6c-08a6-48c7-8a09-ea053781dd14", "comment": "Malware payload (Heodo)", "value": "974c0c804cd9d1699b7a1fb1dd520f31", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644316456, "uuid": "e2c92808-35db-4704-834d-a134e1a1d90a", "comment": "Malware payload (Heodo)", "value": "16bdd6eeda90199d652db301be52de007a614ce473a865efbe9f360913cfb31b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644316456, "uuid": "9ca1be81-e657-478e-be93-42f26c0f5ace", "comment": "Malware payload (Heodo)", "value": "ee592dc4e240bb3d4c2f58099f52b81592a47e07", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644316456, "uuid": "ffa1c0d8-3bfa-4e5b-b0a5-c22787b0d253", "comment": "Malware payload (Heodo)", "value": "0a63ddd348593967d657af2109f3c4bab6b0df3c9b514eb207fca8e9a496784d3fbb95c95b8c25188441e2bf55c32569", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644316456, "uuid": "d829afb1-f1e5-461b-878e-3e098d15824e", "value": "T1A793499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644316456, "uuid": "fe45b642-8270-4402-8334-91b7a195b28c", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644316456, "uuid": "593cb0ee-ce4f-4555-98bb-d6fbeca39c5c", "value": 96408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644316456, "uuid": "ec38dc91-44d4-463c-9ad1-0b846409c9e5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644316456, "uuid": "a600bb96-efac-4829-9e87-a6cdf130a801", "value": "tmpk2esz5eo", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22a94a61-887e-11ec-9275-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1644283587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283587, "uuid": "71b8ed1a-0660-4443-9c75-e64a36607526", "comment": "Malware payload (Vjw0rm)", "value": "4aeac345ff0d52f7ea2e9a9b9de73cb4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283587, "uuid": "58274f52-557f-4a20-a8da-1c4ecb1c1800", "comment": "Malware payload (Vjw0rm)", "value": "16ee8787395039445c472df4c45834ac3e6299f753764dbe27b9bc031e383a9b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283587, "uuid": "88a3dafa-b4d3-4f15-8eb5-fb5c025ab299", "comment": "Malware payload (Vjw0rm)", "value": "cb3c9866359b2db03f80f9715cc84a3d9e743f12", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283587, "uuid": "eae95fab-937a-40f7-82c9-21a602bd09d2", "comment": "Malware payload (Vjw0rm)", "value": "6121d771f78db51ed267c0b33fa61c12ac07a5610ad027cd6ce340fa9b89b31edf2206392d9d9ce79a02c62e026381d7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644283587, "uuid": "0726c895-e703-44d1-8d72-24d8bbc6b1a9", "value": "T11E5343C06AC1F88122476B737B1AB0F5EB2A1ED871C44C9DF144B4A0F0DEAADE9D9571", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644283587, "uuid": "fb6a6a58-401e-446c-98dc-5516110ae2f6", "value": "1536:SBM7nCeql/VHNPDRL1Ch+RuW5TerkNUV138NBu+:SBMzCeqlVxRIh+RuW5TerkNUV1MNBu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644283587, "uuid": "b92cc348-d867-4436-a9f5-e8f9635b630f", "value": 63090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644283587, "uuid": "15e1847a-da68-4f01-8995-442dceeaa107", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644283587, "uuid": "853d1556-3433-47ba-a609-207251eb5029", "value": "RTK009ENF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93cd247e-88bb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644309976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644309976, "uuid": "b3627a7c-10e4-499b-a7cc-8dfdf6941372", "comment": "Malware payload (Heodo)", "value": "6698c47866b2c34c4e808a037e7cb9f0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644309976, "uuid": "0ca4d9ea-11ac-40d0-884e-ab32b631d364", "comment": "Malware payload (Heodo)", "value": "177b81986157e2cebb9147606f3f098adc9fad3ebf66ef2d5ee84aa5593afe64", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644309976, "uuid": "043673fb-6b98-4063-809b-1f7e3c44b5fb", "comment": "Malware payload (Heodo)", "value": "ebe1799e084f5fa56454ec2c9c7bd9a54e9608b1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644309976, "uuid": "bd907607-5ff0-48a8-b597-7f39e29c858b", "comment": "Malware payload (Heodo)", "value": "d6ee8d9cb5644f4e94f20254e63689c783b07f4938dfa4398ca3ba11f9078b0228982a66ec15e21d38c9dea03814c380", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644309976, "uuid": "4a827e12-33a9-46fd-92a8-5cfe3849c8f1", "value": "T1C8C36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644309976, "uuid": "204e66a2-6d32-4f52-b8fb-4cb1a403a521", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644309976, "uuid": "a71f7f86-a05c-4b27-8b25-2d2edbe78d36", "value": 127515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644309976, "uuid": "16d2f562-3b39-4e5e-8d4b-d8f781d77c60", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644309976, "uuid": "fa84d951-647e-4cff-864b-3037fe60b455", "value": "tmpzdxhvi7s", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1296f0-8901-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644339952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339952, "uuid": "26ec35fd-7bf1-4bd8-b22b-b30e8a08f7cd", "comment": "Malware payload (SnakeKeylogger)", "value": "08c12d72a787487e0c7cdc00006d4199", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339952, "uuid": "d7fe5c20-f2f9-4691-8e4a-0d2aca00e873", "comment": "Malware payload (SnakeKeylogger)", "value": "17c5f5a2c9fb2b6812f5497c959539ff8e3639c5a1deebf7b6545ef2314d6ad2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339952, "uuid": "ec22e8a5-90dc-40bd-a66e-557766372ebe", "comment": "Malware payload (SnakeKeylogger)", "value": "c492441a12ef19853848320df9006eb29ce0a165", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339952, "uuid": "bc1e6ec8-e013-4598-aa21-a8a829ada413", "comment": "Malware payload (SnakeKeylogger)", "value": "d971ea2062851b43eb2c6b1ab506006970df845052711dffd6f45ba878db1e6515666458462b10a8b617427ee7703a73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339952, "uuid": "9736382f-ee9d-4e0d-970d-e3a05a9b7839", "value": "T11BA5AE80B7EC5E16E1FF6BBDA97102446AB6FD156736D30F4268E5DA2D63B008D42323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339952, "uuid": "7c791dec-5711-4c7b-9027-aa98133636d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339952, "uuid": "aab28718-a907-4345-acc6-0ab5700b6f8d", "value": "24576:qmAjxvbZFRsMWCxnUSh+7gBfpge6yzL3tIMhWYgSrsLAG37VwwBJaW5G:qhxvbZ1Wqr2EgpSLaL5LAkV2Ww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644339952, "uuid": "bf89be2c-3ba7-4150-8906-c5f0763ead5a", "value": 2093056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644339952, "uuid": "45f4c7f2-f3f3-49bf-be8f-fc82e8f4d181", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339952, "uuid": "5ccf01cf-eb50-45b8-8670-49e88bfd1fb5", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a7e0228-8896-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644294042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294042, "uuid": "5c2373b0-7b7b-45b0-94a6-3d126e44fed7", "comment": "Malware payload (Heodo)", "value": "d7fefb17d55c555afaf15d8be0900ab5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294042, "uuid": "51532d92-8269-4c0a-b7ef-032dc72b3b1b", "comment": "Malware payload (Heodo)", "value": "17cf31ebf1291a8036dee6611ece5051407349f7bd1fffc2d85d0377c79b9517", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294042, "uuid": "0fb6f666-6284-4210-9c39-869773b6334c", "comment": "Malware payload (Heodo)", "value": "61d82cd56dcb787e137d0c41ee47be3204e43fdc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294042, "uuid": "3fd6c0f0-a31c-4788-b4d8-35bc8ad261c3", "comment": "Malware payload (Heodo)", "value": "67a06fcc020b6f3f3c43a28d37592ee5e6a1bb653298f467b29c1327112dddb168f5b57fb875b940df75a614ebedd117", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294042, "uuid": "aa7186ff-67f0-4673-a208-2b5b59cfd6bc", "value": "T14A93F16E6E5C2D0BD6DBE238DF3DDAA083541CD06592F4B970A17FA9003D493C266E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294042, "uuid": "6f5f482d-5ff2-4ca1-b1a9-026fdc527620", "value": "1536:zZRkPTLymcPCvk0WpiSKa3Xm1WBXz7yL64i+kkfa+3gtfvjHtoxzg5bjIFda:zvk7uZCs0a3Xm4nC5X5gxvhoxzMIHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644294042, "uuid": "cd14e559-faf4-4df1-b261-1507ae2ed0b5", "value": 94223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644294042, "uuid": "3ac2af99-a9c1-49db-9263-68165e328875", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294042, "uuid": "d96ac931-afb0-4498-8ed2-760ec1e14046", "value": "tmpu37bvspw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab48083c-8899-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644295412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295412, "uuid": "a298a622-8c88-4a99-863e-d27f4c2fe087", "comment": "Malware payload (RedLineStealer)", "value": "56da9aa053adec2eb685d9f81532ad23", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295412, "uuid": "70d23b19-5e3e-4dda-87c2-04f585fdb9aa", "comment": "Malware payload (RedLineStealer)", "value": "18354bab9009498b48010c0acb0eba274eba5b9d27f197b773b9c376d7932167", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295412, "uuid": "c2319522-8288-440b-b213-d27ab0f3eb55", "comment": "Malware payload (RedLineStealer)", "value": "58e47cd4abf19c6a2ddc5d5dc2cbad2e90f68a32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295412, "uuid": "3b2e9af2-0c7c-480e-b0b9-4223f71265b5", "comment": "Malware payload (RedLineStealer)", "value": "eb08df11c545c7e7bdff9bd4d1270c4cd07b2c157b4a8b2e81fe83f9174aa22bc16daa053e93d169e4ade12b072b47b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644295412, "uuid": "df04ddc8-c2af-4fa0-88a9-b5ddc87facd6", "value": "T1BFB4A5343AFB9019F1B3EF75DAD87896DB9EB7633607E84D208103864613A42DD9163E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644295412, "uuid": "ef077be5-65a8-4490-83af-f9c36a3c65d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644295412, "uuid": "653c7109-3faf-4f2f-b7be-0ab4c0aa6018", "value": "6144:H74zIBgx6arAMrlvUbKW2+PYF4zA3NOFcM9OeGkKmdUcm7q:hgYkAMrlvIl2+PA4zOQF99OhkKMUt7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644295412, "uuid": "660ba1c4-aabe-456e-9917-7a73e525ba3f", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644295412, "uuid": "d33077ac-f2d2-4199-8fd1-7b923b3d99f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644295412, "uuid": "460874bf-1415-46e9-9de5-3cd738ac1f4d", "value": "56da9aa053adec2eb685d9f81532ad23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7617fd8e-88cd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644317657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317657, "uuid": "ef19c829-e531-45b1-9343-001f5d082d3e", "comment": "Malware payload (Heodo)", "value": "7af509d5a768537d2f93b6712b6f88b8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317657, "uuid": "351b67f4-b61b-4ef6-84ed-c54f5f325924", "comment": "Malware payload (Heodo)", "value": "185434ad5b42d9f5f09a345ae9bd2083ec860f3a76a6620ee2de75bb54305ee5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317657, "uuid": "b4c29ed9-75e1-473a-9fd5-3c138f3b0f9e", "comment": "Malware payload (Heodo)", "value": "f28144e511f97d83d83806b0aa0d9aa48721846d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317657, "uuid": "910eb16b-e228-487b-a3bf-18e7a54fdbfd", "comment": "Malware payload (Heodo)", "value": "7b43e2db3875a8e29f6e6e0605ec43abc476df95f2dab83ce5daa3faf00b850daf315b9e9ab4a087b21ad7c24be82826", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317657, "uuid": "2fcf220b-2565-43a7-9c1d-6fbee115a80f", "value": "T157C36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317657, "uuid": "11c348b5-5987-48b0-98ad-68fe65a9a04a", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644317657, "uuid": "d70a6888-07a0-4d48-96f7-8ccce254c990", "value": 128451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644317657, "uuid": "dc304f72-1f9e-48b4-ac71-6aa4a3930872", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317657, "uuid": "623b5b1e-c4e8-448e-a25b-ba820f485817", "value": "tmpe2ytattz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25387be-88ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644330267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330267, "uuid": "ba48240c-49fc-4922-96ed-746ba3d8dc69", "comment": "Malware payload (Heodo)", "value": "3e3d6f8be748b7a9251da2b5e790ddb8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330267, "uuid": "e795c34f-5a06-4c6e-82a2-9a06bdb7c001", "comment": "Malware payload (Heodo)", "value": "1857cceb0f7f2bb344dadf63955d69cbb8a8790784f749062b2d78bf6dcace82", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330267, "uuid": "9c2254de-f61f-4d07-ab5d-e43eb73fc29a", "comment": "Malware payload (Heodo)", "value": "890b05e5e83983012ff1026215ba57959594271f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330267, "uuid": "0018d110-7ae0-4577-966b-95c1095028b0", "comment": "Malware payload (Heodo)", "value": "06449ebd391c90fb97eeda0558f773dcc805b661353c0cead0829f1cb738f8b4f9b8f8ef0adbb50873fe42a481fc5eb3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330267, "uuid": "f74a6930-f3eb-406f-ac61-8aa0847d2633", "value": "T197C35A55F685EA1ADE0823350DDFC7F9733ABC828E9683473299B32F7C76550CA12606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330267, "uuid": "6a278e91-0f3e-439d-98a7-1f43de2a7dc6", "value": "3072:cFcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgcBj:qcKoSsxzNDZLDZjlbR868O8KlVH37kes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644330267, "uuid": "f97b1c31-2789-4c07-8497-4912c69cd46d", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644330267, "uuid": "e17da8bd-0028-444a-b615-16a502aeac22", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330267, "uuid": "11f574f4-084f-4e6f-ad97-5f075247a3b1", "value": "tmpw2tgcnxu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "affd6101-88b5-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644307446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307446, "uuid": "00dc2d41-2a76-478f-ba40-5f5ab6d251b4", "comment": "Malware payload (Loki)", "value": "99df554da619fd7566aa4eec6abf91cb", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307446, "uuid": "c7032847-edb4-4ca7-b4c9-52c1b24699c3", "comment": "Malware payload (Loki)", "value": "189983348fd14c49c7a9e6cfb3177926fbf84defe004f0a2d2326b5b79cfd6ab", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307446, "uuid": "cd8b636e-69b1-428b-a3bb-b96a4f6511bd", "comment": "Malware payload (Loki)", "value": "38557fd4ae6774b0ec62aefbc44461a2a9418be2", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307446, "uuid": "f7a210fa-2d41-4cd9-971a-fb3bc5e938a6", "comment": "Malware payload (Loki)", "value": "c13de192eef5832afd4006a4d972407f7f17a219d52e1a61f7b9605df93c2ac4866420e4b9375cbe4b07e0c8ffc2bd2e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307446, "uuid": "35d50401-89c7-4152-8a4e-eb86e1dfe415", "value": "T11D141226376CF689E2CF153CAE50A5645F3DDC0A8A6B5475385EFA1CFA36842284FC13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307446, "uuid": "fc23a49f-f662-4c7c-845e-2c42efa62056", "value": "3072:XmNXlMYdoA8gAB6wtyd4i0oQXwntiqzbjjVPV7cahhxZeDCgwcdTTm6LYnxwgX:2N1LURyd4iaX2tDPV7Jh0DCgwchqnzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644307446, "uuid": "d00c7cf3-5f86-4ff2-be39-7bf674e06003", "value": 191880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644307446, "uuid": "dc3656b6-928a-4130-942f-738b2d727208", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307446, "uuid": "bc0a2635-d15c-4cdb-aeb4-9e99887d99fc", "value": "CLARE TC DESC.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddfca948-88ed-11ec-9275-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1644331575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644331575, "uuid": "74449b34-50ce-4c12-bb33-a91051df6a55", "comment": "Malware payload (IcedID)", "value": "3bfef2a13f7cbbe2c872bef76adb676b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644331575, "uuid": "ab55f05b-a6ce-4ad7-8c06-a8a45e672015", "comment": "Malware payload (IcedID)", "value": "1909a177d8f646c0993e5e58347e1a0b39b71dc45ad4ae49faa631683c18a3e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644331575, "uuid": "ceb48448-ec72-4392-962e-b17048a6fbcd", "comment": "Malware payload (IcedID)", "value": "dd972d20477223b75ffddf0b2e65b533a431aa14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644331575, "uuid": "892e3cc2-0de4-4231-b080-99c947084477", "comment": "Malware payload (IcedID)", "value": "77b5c04c1cfa12431a8a6c4dd3635e547f60a5ae2c90d57fe80827b46f1c0b1920447b2aed1385644760e872df7d9af7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644331575, "uuid": "b57b52f6-8e47-4097-a2e6-c0a0ee657c94", "value": "T1ECD4AF39636507B5E0739434C9734943C6F17CB117B095EBA3A1325A0E3BFE5A63AB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644331575, "uuid": "411510e8-de0f-4090-a8b9-20aa2660803b", "value": "01f87ec9e1e36146b71b7ffce4fd5fa9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644331575, "uuid": "944d775f-49a2-488b-b1a1-bca3fcb897e0", "value": "12288:FTsor70Aeojgc4+o07OCi6HY7FpW0zm0pF:FTXjeojgc4+lDZY5pF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644331575, "uuid": "31e69eea-1de8-47ca-834a-63e8123c3b92", "value": 630064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644331575, "uuid": "a155a967-5fb2-4436-82e2-3c3a46058f34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644331575, "uuid": "e034dfd7-99cb-487f-b18e-77810f682ada", "value": "1909a177d8f646c0993e5e58347e1a0b39b71dc45ad4ae49faa631683c18a3e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ddd259e-8928-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644356727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356727, "uuid": "a7366fab-c776-473d-9108-143b2882f4a5", "comment": "Malware payload", "value": "bc367dc05bc9a57771f76bf079e49053", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356727, "uuid": "7e969164-3dd6-43c4-b458-0ec71d7ca775", "comment": "Malware payload", "value": "1914903bb73bab6168043979ac1c8ec640d9ea23a2e20b163d4b18c49fe2c973", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356727, "uuid": "29ac2ff1-1314-4096-89fa-8abe4fc16e67", "comment": "Malware payload", "value": "17fa93f2c4b6185bbe307d6a69afd38dbaaaab8b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356727, "uuid": "54b8fa2f-82c3-412d-8d4e-36f1ec658344", "comment": "Malware payload", "value": "d2bd38551778b0aa5dc6a27486de5a5b759d1b034898b71d10d28d732d17ea19e373de314b7722f1048293d5942690e4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644356727, "uuid": "9b308f63-e1ad-4ae7-bba9-d45a20aa2c1b", "value": "T137C35A55F685EA1ADE0822350DDFCBF97336BC828E9683473299B32F3D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644356727, "uuid": "1310ea24-3b30-4101-bbca-a0e3f4a6c8a8", "value": "3072:4CcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgiBf:hcKoSsxzNDZLDZjlbR868O8KlVH37keq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644356727, "uuid": "70b2212c-0e97-41a0-ac44-0f9f9cd139e4", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644356727, "uuid": "6c39219f-265e-4570-8672-9d4c23fb290b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644356727, "uuid": "6b002243-c7ea-41b7-a575-b95a7fa89bac", "value": "tmp_32laagp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "accfeb43-88ad-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644304005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644304005, "uuid": "9cc359f4-da66-4dfd-b129-a64416e78142", "comment": "Malware payload (Heodo)", "value": "0059d709f81c5be4899f0a822e2e466f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644304005, "uuid": "083a27f3-4913-4c96-ae4b-108a332f5866", "comment": "Malware payload (Heodo)", "value": "1914ce1227ce46bbbb8ea791151cf8639f4c783108764812bdb532cd672c50b7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644304005, "uuid": "0a6853a8-c865-4e7d-947c-07dd0e09af3f", "comment": "Malware payload (Heodo)", "value": "0f5eb4dfd56051fa2943be4ceb977576dcafae52", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644304005, "uuid": "4d3a2deb-a0b5-4b9d-a620-70b3cee09abb", "comment": "Malware payload (Heodo)", "value": "1017591d43175d925fe5f32f3aa957e90f0b7e4292bc0d1d9f3e1cbd43019fcbd86c5c52856372d639cee05b598dfd40", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644304005, "uuid": "ebcc2da6-21e6-4b25-b899-fb0b38c1ce96", "value": "T12E93499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644304005, "uuid": "68211f0b-f1ca-40cc-b190-b141ea99de69", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644304005, "uuid": "ee321d55-4ee3-4a17-8d68-79488322d877", "value": 97320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644304005, "uuid": "41e33f2c-905b-476a-ba1b-a3c940c3e257", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644304005, "uuid": "7720034d-03fc-4e05-805d-e2803f26d3db", "value": "tmpfe9harrg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc89f46-892c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644358551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358551, "uuid": "224da0c1-7b38-497e-a6aa-3cf2afb0f69f", "comment": "Malware payload", "value": "94ff8e6ce2f44a19c9c6feac6454a11f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358551, "uuid": "a6b7e399-f299-4f7d-9318-dfc116209286", "comment": "Malware payload", "value": "19334b167152e5a9dc80093bed73856c1c2a89f4755ac48f277aa7e0c524cca1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358551, "uuid": "29091f6e-5160-4f64-ae9e-56c926f92531", "comment": "Malware payload", "value": "6f46a45677f440f87b33779cf73d323321119201", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358551, "uuid": "b4a5ef4a-a711-40cb-a0e3-273f2f3d7e7b", "comment": "Malware payload", "value": "d7707ebdbf9c1b433ef6ee6f68f3cf2c5d93378741998b33b3be299ab6cbe60fdbe8a15277a07f3dd62dffa5b3388ee4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358551, "uuid": "6d62e617-f9c0-4242-ac16-6ad2f0d766c9", "value": "T1A0C35A55F685EA1ADE0823350DDFC7F9333ABC828E9683473299B32F7D76550CA12606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358551, "uuid": "b14dda25-18d8-4e61-98af-513a1013745b", "value": "3072:3VcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBw:FcKoSsxzNDZLDZjlbR868O8KlVH37keM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644358551, "uuid": "94cfc49a-7107-4a50-9047-f6c271017e75", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644358551, "uuid": "4c2b463f-b10a-4439-8dd5-cf6bcf8f693e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358551, "uuid": "5ab4fecb-c99c-4c34-822c-bd55f7f9d121", "value": "tmpc9veey0v", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97576852-887d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644283353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283353, "uuid": "5622bc6c-63f3-4435-bafc-a4ad7f3b8353", "comment": "Malware payload (Heodo)", "value": "ac61acb75b67a45100f7f6817ea7154d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283353, "uuid": "427b9978-2c65-46cb-9446-ec1f978ae3bf", "comment": "Malware payload (Heodo)", "value": "1935c5c124f52faae27ee9e41016e342798f47d44e90483b6104effa4a6f4d1b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283353, "uuid": "eabd3a03-db19-42d5-afd1-73d8cb0e3c2f", "comment": "Malware payload (Heodo)", "value": "3ce5dab8e89071a0afa4c09742a8c407ae91d0d8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283353, "uuid": "eba41cd3-ab0b-4e21-a59c-a5a5a8d1f622", "comment": "Malware payload (Heodo)", "value": "06c4ea1688c4b864d1182e5958b30ce04bd3a7e6cc7485869b63f91c2c8ee57dc387d68171accf7719ab6291a3686439", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644283353, "uuid": "1ab5ab5b-5a71-473b-9f32-4873ad458198", "value": "T10693F16E2E1C6A07E4CBF234DF39DE5053155C906AA2F8B960A1AF79413D493C07AE6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644283353, "uuid": "d273e6a4-01c9-4c96-9f38-9c1e2e113b3a", "value": "1536:zZRiRVqJWobKaTEePWW8VdDLCNSKa3Xm1WBXz7yL64i+kkfa+3gtfvjHtoxzg5bP:zvAVqvoe58fD2Pa3Xm4nC5X5gxvhoxzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644283353, "uuid": "32425beb-1ad0-4569-ab9f-7b4c728ff56a", "value": 94224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644283353, "uuid": "b2b4eb0d-591d-4494-8da9-2229c7cf783a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644283353, "uuid": "dcc61ca1-48d5-49de-b875-5bf8d8496036", "value": "tmp_9d1typc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8660c226-8881-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644285042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285042, "uuid": "d25d5a85-0f1d-4770-8009-f0db78f13a81", "comment": "Malware payload (RedLineStealer)", "value": "aba5b7b1870763f14f54509030016868", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285042, "uuid": "548aee9f-6094-4821-abd2-cba76cfba654", "comment": "Malware payload (RedLineStealer)", "value": "1991f9f70a0d2bb52793de690ee8522977438a0cc6efb6ff67fef64b267f74ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285042, "uuid": "d9ee9538-e80d-4a78-93ed-a6f22e731be2", "comment": "Malware payload (RedLineStealer)", "value": "65ff546eab0abd9d89fda27d3e2603a96f5ae140", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285042, "uuid": "e6e48f42-acb7-47b3-83f6-a1bd36f719f2", "comment": "Malware payload (RedLineStealer)", "value": "c7a2370f13baed55a7430c5cb53e0086a18d06185f8a60049dbdb0ea23068703c905048645705beb2f93d0fe2afcdb1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285042, "uuid": "7e31abd2-6277-40b2-b5e5-8f1a560e127a", "value": "T145251201FAC68169F1E22730CB7ABB169A39EE71173842C797907D57A9743C26E7C342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285042, "uuid": "d47680e5-a933-4334-817b-504054c99587", "value": "31f703552d204daf7c2d3dbfa12d709d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285042, "uuid": "b657c9d4-7ff3-472d-8562-4befd3dadf21", "value": "24576:D74/ZWGHPrS1AAqSxqWpJQOXxq8PEZoZWyFy1SoGzAPFrj7Kmi:D743szNqWASoorFy1SoGzAPZ7Kmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644285042, "uuid": "52701850-f9a1-429a-abd2-3139fe4afcb2", "value": 993343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644285042, "uuid": "5726d7f8-a800-4f83-980e-f21c03be6527", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285042, "uuid": "3622385c-3d3d-4fd2-ac1c-899d2f4203f0", "value": "aba5b7b1870763f14f54509030016868.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d452a69-8902-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644340459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340459, "uuid": "7fe09cf0-e129-4f9f-8b54-8de628d7e2aa", "comment": "Malware payload (Heodo)", "value": "90ae6e3f74061aecd2f5f1512e547d89", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340459, "uuid": "05ed80a4-80f8-4e08-b4e1-548ca25dac19", "comment": "Malware payload (Heodo)", "value": "1993970f074573cd9635464ef84891724cab97c8d9dacc4688b30d0325de748f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340459, "uuid": "979305a6-5bb9-4389-9589-c0ae3fc9580b", "comment": "Malware payload (Heodo)", "value": "27c4d812e7b2a1b45eb916d27cf0bc7a389fb332", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340459, "uuid": "658f4bcf-4fd3-4e13-b056-aa27bf10506a", "comment": "Malware payload (Heodo)", "value": "b4f8715e337aefa37e81fc8be52426880f5ab09894ad8b0c67ec84adc663a0e873b8bc8794d6f32b6d104c6a9ecdc577", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340459, "uuid": "3dca3cd7-5da1-496e-ac40-e1275c15768c", "value": "T10BC35A55F685EA1ADA0823350DDFC7F9333ABC828E9683473299B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340459, "uuid": "b712ce9f-6e6e-40a7-9e9a-881a9b0ee06a", "value": "3072:5KcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBz:gcKoSsxzNDZLDZjlbR868O8KlVH37keP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644340459, "uuid": "1c328db6-fedd-4e1a-b512-efeb7b563d65", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644340459, "uuid": "47e26c2f-093b-4fe1-8a98-b8e207dccfc9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340459, "uuid": "7d7da025-43cc-410b-bd68-f99c471e5b9e", "value": "tmpstopvwat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df70e29-88a7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644301322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301322, "uuid": "228e5992-ed24-4c78-bc0e-318e2e5f98f4", "comment": "Malware payload (Heodo)", "value": "18491b3c28fbc573568e401a3343c7c2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301322, "uuid": "3dedddf2-b0a4-4b38-a2e8-2ffb0283f21f", "comment": "Malware payload (Heodo)", "value": "19985691a0ea2efa1e43d8c13013cb9b7532be6e0d30303a42422a439c2eb520", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301322, "uuid": "7c0881fa-3340-4582-8b2c-e66dfe4b0ec2", "comment": "Malware payload (Heodo)", "value": "e3dd014adcd2873d947b34b583553bd34b7ae054", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301322, "uuid": "13e9d98c-191c-480e-a2e8-66613f11fb70", "comment": "Malware payload (Heodo)", "value": "b044278a7ac490f79ef0990ecafe4ba7777e09b9966c6595ccf60402c4a379506e22c1f4401958a5d830568ecba59496", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644301322, "uuid": "433b7504-fd45-42e3-813b-ab83431065ce", "value": "T145D38D6ABA48CA0BDA4953314EE7CBF67335BC819F5297473295B72F1C3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644301322, "uuid": "22e6ef2e-3e06-4e55-94db-4d745320de24", "value": "3072:VcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3G:VcKoSsxzNDZLDZjlbR868O8KlVH3ske/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644301322, "uuid": "2d69bd51-d69b-4da3-b156-93e41e1fc716", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644301322, "uuid": "6bec74dc-b332-4f59-aa95-0471408d06b8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644301322, "uuid": "53e395cf-3826-437b-ad69-40f6283ed225", "value": "tmp2b2xyl9z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9142b57f-8905-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1644341754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341754, "uuid": "8ec74382-4ca0-4ea9-926a-97e149daf094", "comment": "Malware payload (NanoCore)", "value": "99492ef20544298097d5058aa1649b77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341754, "uuid": "876f9add-32f2-4609-97ed-f6182df0480b", "comment": "Malware payload (NanoCore)", "value": "19a0456b128a125db6ec9e43ac48d38291d4e9f963cb420fb93126acbf7e76f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341754, "uuid": "0a32c8b9-0554-45de-8c04-4d4d446bb87a", "comment": "Malware payload (NanoCore)", "value": "ee1fc5766023b50332c17e83ed029ba68a631aff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341754, "uuid": "402fca82-0afa-4fad-8fb5-6e648ebfd6a7", "comment": "Malware payload (NanoCore)", "value": "16f6d50d7bff4cea7a576fedb9c7c4908e9b12a299295e0b4a29c04382559e1255dc419b28dc68563a44b8d3e8bb2b3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341754, "uuid": "230b37d2-d884-456e-9bc3-93e75fab4d58", "value": "T19864229922C099EBD96686B10C3BEF7ADF6DB6501716650F8BB05FFF281B0C2401E746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341754, "uuid": "0bff5e01-9eda-42ef-83d6-77d664e33129", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341754, "uuid": "d53e4896-ca0e-4aa8-aec3-a6ce97b4b00d", "value": "6144:owkEJFbvOpiWzYtM5hfD9mwaRRXCZ/pCzgBnwTzuCiJlMDau+7flI:ZFbAfzYtahrYXCjCknwWCik+nfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644341754, "uuid": "e7c04834-188b-44eb-8cf5-7859e3c760f4", "value": 325585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644341754, "uuid": "5966724e-8341-419a-a5bf-061507b374b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341754, "uuid": "5802f766-0e55-46d4-aaa8-90fca11b2f22", "value": "TNT AWB TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b057fea-88f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644335543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644335543, "uuid": "06ce355d-36da-475d-937a-cd5a9bcecb2c", "comment": "Malware payload (Heodo)", "value": "1b6619deb722874c20ad15222a93188c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644335543, "uuid": "91875653-e79c-418d-9cbc-80051d9835cc", "comment": "Malware payload (Heodo)", "value": "19a9ae822558a5a2069fa6167f54be991ee4ecf99b0dcc358c413d5386b52b9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644335543, "uuid": "13547095-7927-4bf2-a35e-4ac8bb738ef8", "comment": "Malware payload (Heodo)", "value": "29f8d11ac6c1aff0897ecb10f0f4ce5700fc82b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644335543, "uuid": "484e58d5-9ea2-4a76-82fd-5ad1c67fe179", "comment": "Malware payload (Heodo)", "value": "787497af0eaec37ff9431240c39ecb66a4e524480bc8f3acb3883e9d42394523e0d49168b2d35e2b555a0e6731dd4911", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644335543, "uuid": "a9642600-51c8-46ce-b9be-d58ba04d15fd", "value": "T198848D06E652C03CFEFB04B8D496CA66ED5E3A24169D619F63413A6D32613CF123F52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644335543, "uuid": "504895c2-31c2-49b9-b97c-3a674afa126d", "value": "79fb40281049052b3e354a6e444da473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644335543, "uuid": "ef56083f-d713-468e-9a41-687909dcbd3c", "value": "6144:O56dLjBFLyztOoYeYIjAmkB8lebi9JqGXdZ32mneM0laNUIbeURK46:YszuzN7jWB8f9JqQ2mnB0l4UMK46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644335543, "uuid": "47028991-c217-4606-a6e4-2a748bdd73d5", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644335543, "uuid": "10c5d4b1-29ac-484f-8ffd-9c9fb169558e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644335543, "uuid": "30004b0d-8c72-4e77-b204-75f0a720d78a", "value": "1b6619deb722874c20ad15222a93188c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9e4cc7-8892-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644292306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644292306, "uuid": "ff4fd445-0132-4d64-ac04-68ba6380c9f8", "comment": "Malware payload (Heodo)", "value": "50aaca7a1816ccdcd836e4ebcf142524", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644292306, "uuid": "08f30b01-3ab3-42ef-abbe-5709addcefd7", "comment": "Malware payload (Heodo)", "value": "19b7d978a08d120b40d7ae243aa662908652d93b7d5796b465bc95d4dd4e81ed", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644292306, "uuid": "91a3df2c-5a78-49bb-8f4b-ba52744452bc", "comment": "Malware payload (Heodo)", "value": "257c8dbb252539b4738129b3d8dad94e4a8265bd", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644292306, "uuid": "2fc3d5ea-98a6-4b5c-b76a-235c24a84c5b", "comment": "Malware payload (Heodo)", "value": "b3a6f908004acca98dfa5a4c0c235f238db5c62bf0b24d7a3ddc4df994b95e49405be615ab7ef271feefe80e78cc2e35", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644292306, "uuid": "854411f6-d1bc-4879-bb2c-3fd1287b273b", "value": "T102D38D6EBA48CA0BD94953314EE7CBF67336BC819F5297473295B72E1C3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644292306, "uuid": "c97db080-099b-4166-9d1c-5bb26e55676b", "value": "3072:CcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgDa3Z:CcKoSsxzNDZLDZjlbR868O8KlVH3skeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644292306, "uuid": "26daa366-26ab-4e07-8557-fde9a0607ef3", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644292306, "uuid": "20e40aed-e2a7-441c-9944-eaa4f500ce9d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644292306, "uuid": "cbe73a5b-8b22-4491-ada8-13ca63ea0637", "value": "tmp71fv0m78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8a5a88-88a3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644299547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644299547, "uuid": "b44cfc9a-6714-416d-9a69-ad3e2c65f304", "comment": "Malware payload (Heodo)", "value": "5e8840f5bef280e78729ea13029a7c80", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644299547, "uuid": "4c9bcc73-89e1-487f-9748-af9cd48d6ffa", "comment": "Malware payload (Heodo)", "value": "19c54efd5da3dc2bdaea07d53221ec030fbd6427a45bad6d2980949e3a88c454", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644299547, "uuid": "a9c271d9-8712-4641-b966-6fa6a4de4fd8", "comment": "Malware payload (Heodo)", "value": "1fe8db1f509a12ac04f77a07cb1de652000fd89a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644299547, "uuid": "2781c7d6-acb0-4bf3-b972-608c6a6d2e57", "comment": "Malware payload (Heodo)", "value": "175382674764a9f70bb48fa768287ca996cd290b0acba16769d1fe2b81e1ce975c993d12e5a163a0c5ba5edb35f9dacb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644299547, "uuid": "eacced41-ab5c-4e92-824e-989177c4ee8e", "value": "T156D38C6EBA48CA0BD94913314EE7CBF67336BC819F5297473295B72E1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644299547, "uuid": "61e6eec0-5511-4356-8612-27c49675ddfb", "value": "3072:scKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3r:scKoSsxzNDZLDZjlbR868O8KlVH3skei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644299547, "uuid": "621236a1-f3ff-4b53-9974-69a219140eb1", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644299547, "uuid": "180ef486-77dd-4641-89d4-922531c8e9e3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644299547, "uuid": "38eca3ec-ca20-4735-8888-4ec7812ec72d", "value": "tmpfptob__v", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "465afe57-891d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644351936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351936, "uuid": "2df459bf-ac9d-45a5-8475-abe7421f7a92", "comment": "Malware payload (Heodo)", "value": "edd9f7e6d509ff7ed0b17fa61ebcbbac", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351936, "uuid": "8d44d2ac-5b40-41fa-90f1-c9273f59cc25", "comment": "Malware payload (Heodo)", "value": "19c6f4584256f2ae29c74346181877c6796572955f9c9a699ea0c61cbcd12bad", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351936, "uuid": "caaa6af7-041c-4563-80ae-784c650e807f", "comment": "Malware payload (Heodo)", "value": "975d8366cd58f21e4fd8f28d9857b5db99dd6bc5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351936, "uuid": "3482b9ad-0bf1-470b-b541-583080f6fd7a", "comment": "Malware payload (Heodo)", "value": "9ecee0ee5e58aa79dc3e58e00a97c62f1c27889053ce7337708acec34ead6debebe561a7858eb2a95022d878886fad3b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644351936, "uuid": "926b440e-6c51-4632-9918-ae78090b11d8", "value": "T197C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7D76550CA12606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644351936, "uuid": "b2e9324d-3856-4ec9-98ed-b09e2626115b", "value": "3072:t/cKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfB5:hcKoSsxzNDZLDZjlbR868O8KlVH37keh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644351936, "uuid": "56194b18-0881-40b4-8fad-721499277b8b", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644351936, "uuid": "6664e436-6201-4e52-a87b-00eabb0be749", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644351936, "uuid": "5fa9b92b-1069-4c88-95ba-c2e7c0085d2f", "value": "tmpb4ijd8wz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af325cc-891c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644351541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351541, "uuid": "2fe0c03d-7611-498a-ae16-5010e59d3ed7", "comment": "Malware payload (Heodo)", "value": "65cf44bc128d8777a6ed76a42fc5da26", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351541, "uuid": "1e7d63ca-3f61-4614-8ab2-286967730a7f", "comment": "Malware payload (Heodo)", "value": "19c7e4432bce7a84b5550ec68e434af258c02d31176ad361f831c1ac59a661e0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351541, "uuid": "f21a353c-48ed-46eb-9026-07773fbe517d", "comment": "Malware payload (Heodo)", "value": "47a7d5b70a2e942b7431d3cd719b6d37401c133c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351541, "uuid": "a7f90e9b-f3a2-4b2e-901b-8223a1bf944e", "comment": "Malware payload (Heodo)", "value": "f3a94a17405a2cd06cd5850bd6740474a9166089bbb6618569b814ef59a4db80f4c95b0f0719a60b6547d5ea8f9387a0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644351541, "uuid": "4d45e167-bf5a-4761-93f3-cb316376c8a9", "value": "T1FEC35A55F685EA1ADE0822350DDFC7F97336BC828E9683473289B31F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644351541, "uuid": "09763bcc-cb1d-4182-8a77-fd8aa771e185", "value": "3072:bfcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBR:DcKoSsxzNDZLDZjlbR868O8KlVH37keZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644351541, "uuid": "d62d626c-ca32-4302-995f-347b1c6d70a8", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644351541, "uuid": "a523bee3-dd36-45bd-aae6-9a9e38389a2a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644351541, "uuid": "263ca6cf-be9f-4e8f-9fdf-26b2a83e3d9d", "value": "tmpmnhb3pv3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4621550-889f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644298085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298085, "uuid": "28129f89-c854-4860-9844-ee698641d399", "comment": "Malware payload (Heodo)", "value": "3f25fe13fb4c1e37d25ce7d835ae7264", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298085, "uuid": "78e15079-e50c-4c77-9661-cd26f3081cbe", "comment": "Malware payload (Heodo)", "value": "19ff2247717eff1408951c6e201600339ae838f2d01d445b3384641f62e83d37", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298085, "uuid": "a4d21ef8-2923-4580-a50e-1850b24ae5e4", "comment": "Malware payload (Heodo)", "value": "d958bd750fcdc124932b8f955bd1ae38c0ba8257", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298085, "uuid": "54dc3e06-8cb0-4b57-916e-ba7ce837dc2e", "comment": "Malware payload (Heodo)", "value": "fa78201d4dd42c6c6152a69dc7d6b702399830b58ae4434afdd63c50613dcbac2918c8761404a34d9b040fad71e38ee8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644298085, "uuid": "4722df11-1889-4c43-aece-b693e41d63c6", "value": "T1E8D38D6ABA48CA0BD94953314EE7CBF67336BC819F5297473295B72F1C3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644298085, "uuid": "db02856e-d537-4052-95e2-a5bfba4d45db", "value": "3072:RcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3C:RcKoSsxzNDZLDZjlbR868O8KlVH3skez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644298085, "uuid": "f2490350-60ed-41b4-a815-14b8a0fb0069", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644298085, "uuid": "f47e2d65-925e-4ff8-b5b5-92ad19b7005d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644298085, "uuid": "0b6c17e5-33af-42a2-ba7c-59b157af954f", "value": "tmpn8j0_gxw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e655c9-887c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644282709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282709, "uuid": "36a170fd-cb59-4abf-9fac-56af24581400", "comment": "Malware payload (Heodo)", "value": "fc7b37fac89ef8a966928eead746534a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282709, "uuid": "e271fdbb-1638-4709-a9fd-c68e6bf5b418", "comment": "Malware payload (Heodo)", "value": "1a0cb6b424dccf5383f2b79789bdc03dea0555a744b7b49d85bab48448e0a18b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282709, "uuid": "6ecd5ca7-5342-451e-a0ef-8bb84d66af8e", "comment": "Malware payload (Heodo)", "value": "394e3274550c619adfdaeb7ae52794cbb1c80ea3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282709, "uuid": "c6f0125a-33db-4338-a331-950c0200c6cf", "comment": "Malware payload (Heodo)", "value": "fa6fd3ae7e06cded8d942eb212569b22a6f20cd65c30632e2348f69a83a44e622ed9b208af9f916f3b831ec1c25a10de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282709, "uuid": "691333b3-fe43-4974-a03e-759e8787e1dc", "value": "T187D429AB3A8FA1BDF17B017A6350FB44E4D27C1A9FBD25D70A86358893F2D054F18A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282709, "uuid": "8f34ab17-a461-4e82-b530-08999a273701", "value": "bf1ebe22ec6f51f906ec295a3a5c6d92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282709, "uuid": "f70aa0e9-cc17-4c12-a9f7-ac6177d79226", "value": "6144:x42k6LwFPw91EDbkUE39P7pyADYzqlEDFmZ4s3wADRcvIpxUIVZFoEXlbeZhp4ga:x409qDb109PdyOYzq3P3fVbeFTi40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644282709, "uuid": "2d7fb945-68e2-4bee-a883-f0cb11c6f84a", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644282709, "uuid": "3d50553f-3cff-4f34-984f-a4a1aed09ac1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282709, "uuid": "8294f16d-6cc8-46c7-910e-92f8dfaf25b8", "value": "fc7b37fac89ef8a966928eead746534a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e26a8f50-8884-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644286485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644286485, "uuid": "f0d0d8b0-a9f4-4bd2-8698-9cbdf4e248d8", "comment": "Malware payload (Heodo)", "value": "a3d7ed51e494df9d19487d48c859e4c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644286485, "uuid": "65fa3768-d262-4591-b96e-d2612be5177f", "comment": "Malware payload (Heodo)", "value": "1a1346e87905264b0b003cee1632cdb450ae0b8510a0a95d48d38821c984282b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644286485, "uuid": "18031015-c016-4532-b1c4-392f7cd5b234", "comment": "Malware payload (Heodo)", "value": "d6908b81007edb67a8fa84bd2ba0ee3ea0a4a48d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644286485, "uuid": "f586bb25-8320-4810-a126-dd63cf6dd0c3", "comment": "Malware payload (Heodo)", "value": "94855487c8c72262f123f4f44fae9e90d1419d8a0639c65ffffb2bea4555d4a6faf5f2eeece73ad61d0b71b86e69ce78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644286485, "uuid": "0b278aa6-92e6-4264-b78a-15a11a82ae6d", "value": "T1F7D429AB3A8FA17DF17B017A6350FB05E0D27C1A9FBD29D70A8A758853F2D054F18A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644286485, "uuid": "77017a87-d69b-48f3-b5a5-23d7e827017c", "value": "bf1ebe22ec6f51f906ec295a3a5c6d92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644286485, "uuid": "6ef18314-72c1-4369-8c8f-cbb2eaeb18f7", "value": "12288:l4WjRiEKWKhqyuYzqtN2H2AyKK6cl788IO/:9KWKh/Zqto2AJuQBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644286485, "uuid": "435e9941-e514-4913-b283-93798e1fc915", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644286485, "uuid": "7cb7117a-5c05-4c6a-9ec7-07a56123e9a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644286485, "uuid": "0f9630eb-3360-405a-bbee-c9ca090cacc7", "value": "a3d7ed51e494df9d19487d48c859e4c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ad2c9a-892d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644359081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644359081, "uuid": "7d6c6e29-215c-42f6-8b8e-2364e1ff43c6", "comment": "Malware payload", "value": "5e63153a5ec9f5720dee59ab9760ba99", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644359081, "uuid": "9b50c1be-32cc-4ebf-b271-d5995569d557", "comment": "Malware payload", "value": "1a1fcdcf58cfd67a1f615dd2c3b922515e80d6dcd46049b0902faaa4a87aee8d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644359081, "uuid": "b6634e0f-cbf5-4d90-b315-7b3ea28893a9", "comment": "Malware payload", "value": "5a70aef3dfd4ab8b9f2c40aeb3c3aad845006863", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644359081, "uuid": "7bfcc83b-a197-4253-a845-0a94a6b3c6ff", "comment": "Malware payload", "value": "983cc21adefd95b158a70a935c585ef32b76ce8fd79a42150cef13b1cfabfb4065f4f468457577b2024cab7e637bb05d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644359081, "uuid": "8a93c65c-da95-477d-ba81-175208d0377a", "value": "T1B1C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473299B32F3D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644359081, "uuid": "0c30bece-2702-42b0-acfa-124e6be45e4e", "value": "3072:3McKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgiBN:8cKoSsxzNDZLDZjlbR868O8KlVH37keU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644359081, "uuid": "38eedc74-fb72-4657-98c2-96007b5d281e", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644359081, "uuid": "f949c15a-2f3f-4407-ad85-2339c3a66cb9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644359081, "uuid": "f00e5e4b-7288-4b2e-87a9-adac6b925780", "value": "tmpnlenoyxw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8accb0b0-8899-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644295358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295358, "uuid": "7788ffc8-591a-42a2-a683-55d1e4c0f64e", "comment": "Malware payload (Heodo)", "value": "88eddc369fdfce0c0ffcda2e6ecfe469", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295358, "uuid": "ea08a73f-d306-4e2c-95fd-d8c35d33e51f", "comment": "Malware payload (Heodo)", "value": "1a2d6a29900fd6e9214f9b9b11a64d3ab50cef3a4991b42d0fb07d7a12846941", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295358, "uuid": "3bb3de32-1db6-4962-976e-368963da28c1", "comment": "Malware payload (Heodo)", "value": "d4a407708a79fcd81e426ac142dd31c5489ede4a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295358, "uuid": "bc85e90a-ef7d-4d00-8e97-bf761be8468f", "comment": "Malware payload (Heodo)", "value": "dd9e766823a0b2a657400f6e1f21a6bdd230835b30b3a12ca1a3da8f621b7fffc9299526cb353ab90b5b548c82c584cb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644295358, "uuid": "b4a6b0c2-df3b-4adb-b3d2-31c3faba98a0", "value": "T16AD38D6ABA48CA0BD94913314EE7CBF67336BC819F5297473295B72F1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644295358, "uuid": "c27a15e8-52c9-41c2-ae95-76745866ea5d", "value": "3072:ecKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgca34:ecKoSsxzNDZLDZjlbR868O8KlVH3skeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644295358, "uuid": "67478c65-6581-47c4-b00b-d361fc126ab4", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644295358, "uuid": "0e5a550c-db45-44dd-ad57-964ef5f5f758", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644295358, "uuid": "018c7e04-221f-43d3-9dcc-206d0556b2d5", "value": "tmplb4z61nn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac924d1-88c6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644314578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644314578, "uuid": "9f677db4-0978-4b78-9b8f-b586dcaec42a", "comment": "Malware payload (Heodo)", "value": "d1d55676e7bc72ba9964525365254207", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644314578, "uuid": "f5d4b6f1-9b9a-4d20-924f-0475b1da2f15", "comment": "Malware payload (Heodo)", "value": "1a5c314c41a44bc9d618905c56a65783bba6e2116a3961b9052ee7f1e275496a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644314578, "uuid": "1baca83b-0e91-4962-9329-c9a755dabcc3", "comment": "Malware payload (Heodo)", "value": "0e0e88a35fecbc3ca0493c2dfbd1a6267c5bf5eb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644314578, "uuid": "0fba21a8-8f6c-4cdd-b466-e66f51db3239", "comment": "Malware payload (Heodo)", "value": "4e47e12b32e2d49f424c5bc919f5ca1664503cee404eb1303edd57ba5ea065e1f9356ef5f811d9a28342dea9fa57656f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644314578, "uuid": "c3ce93b1-1896-4315-a68e-b37ef5d8168b", "value": "T1F793499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644314578, "uuid": "d595d70a-92a0-4a7d-b584-f6a106d27753", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644314578, "uuid": "c3bb11cc-36a1-4722-8d21-7f5e0c68fc77", "value": 97035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644314578, "uuid": "24b3ba61-6a35-4b84-a4b3-d0ad1f835e3f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644314578, "uuid": "45d897cf-48f2-429e-b703-05f01e77580d", "value": "tmp72wtalwm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3dbdd1-88b8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644308753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308753, "uuid": "0e6f3ac9-fd27-46f1-b2b3-1fab48be350b", "comment": "Malware payload (AgentTesla)", "value": "fcaf516e61be45d76beda038c51b679d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308753, "uuid": "31bc934d-9d97-4567-bc5b-fce212303c0f", "comment": "Malware payload (AgentTesla)", "value": "1a6454192225907bbd37b5b218eefe23714498ee79b24589916de81afba2b4d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308753, "uuid": "59c68879-3d61-4116-98b4-0403615e6778", "comment": "Malware payload (AgentTesla)", "value": "aca023b0ba6d5067f7bcb7ceae059587df742158", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308753, "uuid": "3e7d0eb7-e04a-4cb4-9fb6-94dee99b1753", "comment": "Malware payload (AgentTesla)", "value": "c4f523adbb8b4543b4c97692c95e64c35646346b9b9082f077670d4eeb63ec9892944601125681551f174684c40750f1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308753, "uuid": "fbe1b5d1-9c6c-4b20-8623-97380c1f0612", "value": "T1CBC48B3F49BF213AC6BCCB7198C4CE1FB866D5863977681D269225D905232F274C622F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308753, "uuid": "ef3b202a-00de-4afd-be92-59e9b5cac64c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308753, "uuid": "e01b714b-cabb-4c5b-88cb-f47d15508d41", "value": "12288:YApS0JcQXwJYFwS3oCaYb/GSiNuwL2tV:YskJWL3faYyuUEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644308753, "uuid": "94bbe8a4-33be-47e9-91ce-48a4d1151163", "value": 584192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644308753, "uuid": "13980a8b-b915-484e-9b02-051a83a84cb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308753, "uuid": "3257fd34-8825-4cd2-b59c-398b4b270aa9", "value": "TransactionDetail(1124).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0049292-88ba-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644309594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644309594, "uuid": "505118e1-bf7a-4e32-b545-4786a9702eeb", "comment": "Malware payload (Gafgyt)", "value": "b605ef187795416bfa2f21b69f322c03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644309594, "uuid": "e3cb995e-c14e-4e08-97be-35de7516f09f", "comment": "Malware payload (Gafgyt)", "value": "1a758aedc61a97af844a310c08ab948acc61567adeffcc2642a828bc6b02a33c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644309594, "uuid": "7c5bd0cf-9718-497c-b8a3-71ca5a8f4380", "comment": "Malware payload (Gafgyt)", "value": "578c9f992391fac01a1ed15e5327c852c09a7821", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644309594, "uuid": "d68b2a0f-726d-47e2-9193-faf5a75c053e", "comment": "Malware payload (Gafgyt)", "value": "aee7755690f3afde98755e525fff7292ad8c2fa39767f58dae1666fcd1a4a83a08f321e74b9a8ba214cfdb1a81e53819", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644309594, "uuid": "82a65c85-112b-4173-848e-45a62cd714dc", "value": "T1A713F171DB49851FD19A24B52C5BBDAC2B25637ECE945BF32D8C743AEC18F843424E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644309594, "uuid": "4dec3677-1f96-4f2a-859d-321b2ef42cb9", "value": "768:uDR/YKlbGm6bsdmeysQhb6OBucaZjS6orzJv6ElPIibL2nbcuyD7Uryq2l5kvX:uFllZSsdmdsiG5ca064zw+2nouy8mq26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644309594, "uuid": "78b57050-842a-48b9-afb7-4bbbb416bc62", "value": 42368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644309594, "uuid": "d6ba6b9d-30a7-49f6-a015-68e375843293", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644309594, "uuid": "a9e41cde-5a18-4fa9-9a1e-ef3bfd8f6abc", "value": "b605ef187795416bfa2f21b69f322c03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb3b505-8938-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644363708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644363708, "uuid": "304629c6-dd8d-4115-96fd-12167f15ab2a", "comment": "Malware payload", "value": "c122d035b2c627b90478293c596b19ad", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644363708, "uuid": "e85e29cf-05e5-40f3-a9ea-db85a1aa8002", "comment": "Malware payload", "value": "1a886d68bb53e9a7e8bdc14efab7a99c6845bca76838c100883bada11bc1bf7b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644363708, "uuid": "18b9b5b8-ff4e-4ec6-b073-918e88f550f9", "comment": "Malware payload", "value": "a1a00f3ca6a79a6dce229dcc0d2a48771ab9a8ac", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644363708, "uuid": "cf52c7e0-bbad-4cd1-91fb-23b6824654dc", "comment": "Malware payload", "value": "a40f61debd79810f73a2c2ede347683d1cef0317dd0d1657d7d9184c9437ed718995d3b74329499b77422e64c2237c5d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644363708, "uuid": "8b3ca273-6abf-46d1-b4f5-826648038085", "value": "T1CCC35A55F685EA1ADE0822350DDFC7F9333ABC828E9683473299B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644363708, "uuid": "b5eee25e-7bd2-4dfd-85f8-2641874cfc89", "value": "3072:BIcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfB8:ucKoSsxzNDZLDZjlbR868O8KlVH37kek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644363708, "uuid": "18fab1e4-f62f-4542-9b2d-4401b4123cd7", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644363708, "uuid": "e246ecba-a21a-4131-beaa-b2dc0ba3f114", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644363708, "uuid": "e792c1b0-297e-4c08-89c7-a49e97b1160b", "value": "tmp_2rnvp8x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d83606-8881-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644284989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284989, "uuid": "ac7dd61f-163e-4fcc-8e3e-2952b5fae92a", "comment": "Malware payload (Loki)", "value": "f4599827b7064b630071c98e1521fef3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284989, "uuid": "0b68b47d-37a0-413c-8c3e-329fd7b63a1e", "comment": "Malware payload (Loki)", "value": "1aab9260ecb3ef6b3d07882eff498982f5146fb73a61ff77f8ea0dfbfb02cde7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284989, "uuid": "5ce5dbf7-66e8-46f9-903d-e34b76354c15", "comment": "Malware payload (Loki)", "value": "1ceeb9da33d6c105a5974ae61af4d203568f9934", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284989, "uuid": "e20493dc-c596-4ac8-9537-490b87b49abf", "comment": "Malware payload (Loki)", "value": "ff6dee91558f34a33f7d36050303622b26c4a67befc590927019539c79197fadc96d670de65390e2e0ecf3624e8d05c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284989, "uuid": "a05617ef-cb7f-40b6-a2b8-17a9c401027f", "value": "T174E4BEAC7151B9EED81BC972DA683C60A63170F787CBC603912B169C9E4DA5BDF004B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284989, "uuid": "5f821a83-fa91-4297-902c-f5887715a0e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284989, "uuid": "86526cd0-1f53-4593-8b01-5a92c178a543", "value": "12288:OcIEZNbW1MeyAwE+SumQlWNdJoR1B/Gz26PM8+Exj6id8aXvjQ:OcIEfK1Me3j+XmJGn/Gzs8+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644284989, "uuid": "8fc5e617-4607-48a4-9c9a-f3d2e9bc41cf", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644284989, "uuid": "6979291e-8cc0-418d-a335-e1c8fbad4d6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284989, "uuid": "5f784506-21d1-494f-b5ec-9e41e15b390f", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "280bd287-8927-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644356181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356181, "uuid": "97f9cf3c-37b5-414c-98d8-6bf188210fd2", "comment": "Malware payload", "value": "6e5c8014db75eeaf0330052cfa4d0381", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356181, "uuid": "438f956c-a5a5-4337-801c-42c1d82c6203", "comment": "Malware payload", "value": "1ac1d3c1e55139b833a90357b97eb05c2d0af3b59b4f73c5ecbfe6a5be0aecba", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356181, "uuid": "af8ef4fe-bff6-47a3-b99b-b1d394edcc0d", "comment": "Malware payload", "value": "d0267251f651b23e9e158d3fff38b2d7ef19dd5b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356181, "uuid": "c1cabcdc-4f57-42c4-b5fe-8e5efb12e42d", "comment": "Malware payload", "value": "2ac9c97851cac31efb8fbe4a8df5d94708fe8a7e02b673996ea8fccb1bc5f195481ec5ca9ccc42cf30b8b9b3beb6eeaf", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644356181, "uuid": "71d0e8bb-eb87-4a3f-b215-74ebb6aba6e9", "value": "T12CC35A55F685EA1ADE0812350DDFCBF9733ABC828E9683473299B32F7C76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644356181, "uuid": "8c2c3dcf-189f-4e49-aa17-e60948d16d37", "value": "3072:PNcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgeBj:FcKoSsxzNDZLDZjlbR868O8KlVH37ke+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644356181, "uuid": "afb0dbbc-f345-4c2d-b041-d6a3a21b1199", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644356181, "uuid": "217fc6ef-fb71-4c8c-96bb-aebfe52adcfc", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644356181, "uuid": "715f7cd2-aaaf-45c8-b887-a7730439849a", "value": "tmpsawqf39q", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b1cf185-88bc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644310256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310256, "uuid": "3168aa85-a664-4239-abe3-67084853f663", "comment": "Malware payload", "value": "9bedb085157870a793f2092413363dda", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310256, "uuid": "0d2a8a1a-45ac-4cb7-ad2f-4614d3edca31", "comment": "Malware payload", "value": "1accedd090d0c8d4bd80e680d84e354b4919a0174cff525b93177f0a176c139f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310256, "uuid": "63f3b226-d1f8-4478-98f5-6e929e92ce31", "comment": "Malware payload", "value": "8daafa905105d14d4c79826f6f03a7d968185c63", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310256, "uuid": "6b89a4bc-f0c2-4acf-92e4-80eb00bc61b8", "comment": "Malware payload", "value": "6688a2277be301c602bbbc5c248eccd32cd3627139a0f88ab45063123482e94350eeec356e74b567a092592f21c5e97e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310256, "uuid": "d3b78a9d-b6bf-4def-975f-47927acbcf2d", "value": "T1555302329A87F37579B97BB1A34582A183192F7D983FF3602723C466F4621C3D0D9482", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310256, "uuid": "1c7dc830-4e0f-488e-9d7b-03f79a8e5a17", "value": "1536:vTm6Anv78t9zmTPNSbv9SWZ7i+RQI3uSqhh5u/P1GGf7GCpODG:v66CvOt557RJehhEXimuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644310256, "uuid": "96ce216f-cc49-42b2-a7af-576b74c06e3c", "value": 64516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644310256, "uuid": "ab9b6333-14a7-43c0-8f2f-157d8a4352d4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310256, "uuid": "5acaebd4-d4eb-4455-a5f9-e5a88b4022b1", "value": "9bedb085157870a793f2092413363dda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2cc43b2-88b5-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644307424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307424, "uuid": "12944efe-940a-496e-9d72-58dd3e0b34fe", "comment": "Malware payload (Loki)", "value": "5a1a9ae9a6091fcbbb924ecac6ebb90b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307424, "uuid": "6cdad29b-fb73-43cd-9b2b-504ce07052ca", "comment": "Malware payload (Loki)", "value": "1aef916f96fdb2c9555e15304cb671cc25a48e5118d6f001a0e574a420a949a0", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307424, "uuid": "068ab1bb-f2b5-4e0d-a0aa-ff67182f1cb7", "comment": "Malware payload (Loki)", "value": "bdf20a75194e3b735432fa4d034ca22f103f3cad", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307424, "uuid": "b70e9478-99de-4472-a015-b35167ce5a0b", "comment": "Malware payload (Loki)", "value": "e7a07c51cdace3d1caa10342013c41aa8d3b013b515c0ed542c6ac5ad456135ee05353f910c3765faf7cd1868d09b8da", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307424, "uuid": "9b06072e-eb83-4498-a7fe-e121b40a3746", "value": "T14E1412123B947821F8217A39607E1B9F60B0DDCDBD6704DED11BBB0DB97099F091A62A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307424, "uuid": "83590419-108e-47ae-af6d-fc4f0ce3ad46", "value": "3072:9NrKqbkM3iCsllEiAOS/Nzo4c6XyglqKby/6garqKsg0CcdPwv:7kMShDhSMung/ng0CIPwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644307424, "uuid": "5efacd4a-8f3c-4324-9d28-301323654093", "value": 191768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644307424, "uuid": "2af072b7-bcdb-4873-b067-5c163a9ea380", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307424, "uuid": "11d7efad-25f3-4830-9424-99521e86aa60", "value": "Proforma Invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f3e846-8918-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644349981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349981, "uuid": "159d6a5c-2ef2-488c-9d8f-ba9e335ebffa", "comment": "Malware payload (Heodo)", "value": "d5fc3c46ebee656340e01d4e16cf4e01", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349981, "uuid": "ca64f469-afd9-406e-8a09-05d93f88e7a6", "comment": "Malware payload (Heodo)", "value": "1b159ed661bd4f58613b4a902c8621a6ec8b48eed58cc7740ea0c555db5e4022", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349981, "uuid": "2125cfe4-7fff-4871-8fd2-bd08d22cf0dd", "comment": "Malware payload (Heodo)", "value": "9d88959f44773ddfbef953abf2844e9894e6ac61", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349981, "uuid": "70f2cfcd-6e7e-4bb3-92d0-ea2e607c00b0", "comment": "Malware payload (Heodo)", "value": "a3a76df86ed35bda0840c2ce9fcb9ae52fb866fddd0148b955242cf04fc55fc18c32a460e08c641602b4a999d058de84", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349981, "uuid": "c37d1e34-60ac-47e2-be0d-84e79995e4df", "value": "T1E5C35A55F685EA1ADE0822350DDFC7F9733ABC828E9A83473289B31F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349981, "uuid": "1848d879-5c73-43b0-9a41-1e1185cb422f", "value": "3072:1BcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBP:HcKoSsxzNDZLDZjlbR868O8KlVH37keH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644349981, "uuid": "edb46aee-7eab-4c9d-be54-379284a7567f", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644349981, "uuid": "9e8f94d8-a712-450b-83f1-ade34681b695", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349981, "uuid": "72f27676-b970-43c9-ae54-aede187dc7d2", "value": "tmpbwfswetb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5426f78-8895-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644293711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644293711, "uuid": "e18cff93-b5c9-417d-a494-903a762d06a1", "comment": "Malware payload (Heodo)", "value": "cc2a5a479478e48791cf23a4b8bd9180", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644293711, "uuid": "1d6c347d-7390-479f-9394-c89b303c7475", "comment": "Malware payload (Heodo)", "value": "1b2a59465370e5764acae0f2be43465dbfd55a41d8405e7bfedf5f6b7966d336", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644293711, "uuid": "fa1ccf68-8760-402a-ad71-1e17713f9248", "comment": "Malware payload (Heodo)", "value": "b8eaf7e10294214041cb1d4868141cec99179378", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644293711, "uuid": "6779b263-2cbe-4870-8758-d5648fa0487d", "comment": "Malware payload (Heodo)", "value": "8418867c48237320060aebd5446fb742487e8c5819247f3af5bf76400ecc9baad6b98faecc4975e8d21133865c5ada51", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644293711, "uuid": "b82725e6-7ba9-49ab-b2f8-4163387c85b1", "value": "T1E6D38D6ABA48CA0BDA4913314EE7CBF67335BC819F5297473295B72E1C3A590CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644293711, "uuid": "8d885fcb-b705-41b6-805f-fcc5f52558e2", "value": "3072:vcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3W:vcKoSsxzNDZLDZjlbR868O8KlVH3skeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644293711, "uuid": "ebf5d5e3-454f-4874-898a-1484b03bfee4", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644293711, "uuid": "98ff4841-f13e-47bb-9569-f215cba6c8b7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644293711, "uuid": "2a119aaa-cfbd-41a7-add4-f7ec74536607", "value": "tmpizxx6cr8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6949f3-8912-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644347172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347172, "uuid": "ec4f5f88-b41e-4014-b98e-5d6dbde173d4", "comment": "Malware payload (Heodo)", "value": "1cd84cf7f533cc82ea5d2ec099c9f83b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347172, "uuid": "2d9a3990-3cb8-455c-aa00-a95fbf3c6161", "comment": "Malware payload (Heodo)", "value": "1b34e3fd7a739f5c12b7b6980981a26f61403949765887f3c1a44d32f45b009d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347172, "uuid": "4f43ca68-d7f2-4bf7-9c18-cee72c3a6a49", "comment": "Malware payload (Heodo)", "value": "637d3173099b67ee0934b30e8aba07cd3fdc7adf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347172, "uuid": "eae8ec39-ff4c-49ec-bcc6-e47cdeb9ba0c", "comment": "Malware payload (Heodo)", "value": "4da2d89a88d61ea7bccf273ccee2fb0ba0ddb32d20b4c9418934fc0bb93c45d2ac025a5e8c9d97c9f2075753323e2788", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347172, "uuid": "4957a3e7-32ab-43ea-87b8-548a1c5e0704", "value": "T1CF748C41E952C03CFEFB00B9D4D6C62AAD1E2E211B9D569F6244366D36603CF163F62E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347172, "uuid": "9a0a1465-5369-4399-a491-d68edeadae12", "value": "79fb40281049052b3e354a6e444da473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347172, "uuid": "3beb31d7-1c17-44f2-a438-b954c5820d7d", "value": "6144:YFF10hIGpvIeY+wBuBqtrgummwYT4ahREWkOieUR6:yKIG5tEnmGcKS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644347172, "uuid": "f97a4d77-0a8e-487d-90ea-8a38e4c6f09c", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644347172, "uuid": "28fc2c0f-4e13-4a50-8b66-19a5f956997f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347172, "uuid": "fa85bc02-6fdc-41c8-b266-b50b0985544a", "value": "emotet_exe_e5_1b34e3fd7a739f5c12b7b6980981a26f61403949765887f3c1a44d32f45b009d_2022-02-08__190558.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba323360-88ba-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644309611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644309611, "uuid": "1d4f19b4-9ab9-4f3b-bdf4-ffeae07788b0", "comment": "Malware payload", "value": "02d3a54cfa60acdacc1d6b249c0d48b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644309611, "uuid": "b031409d-5c52-43d9-a4e5-a0c2fda281ae", "comment": "Malware payload", "value": "1b52c3d75415ac6cbb1afb433378a82d0da29e42308c0b4716711abec459f7b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644309611, "uuid": "ed5766d1-7af0-4226-ab87-f67d1e7ff5c2", "comment": "Malware payload", "value": "f20997c5ca8c46c69d7c92097b6bf26598feb101", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644309611, "uuid": "86ca821d-5674-4528-82f1-dab43e07be9a", "comment": "Malware payload", "value": "1ff8008f481697c52d317b3808b4edbe38798b10e5857e492b07ff5136309b1a11e2852247352abf0e65a8bee0cba1e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644309611, "uuid": "58e26853-2df6-4b3c-91a3-ecb95974e435", "value": "T1981302E19D476F31CBB37C3BED3F544701B142B80427B827A9852311DBA9982A7F850E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644309611, "uuid": "4a2c1c18-6d56-41be-bc5b-89fc2c78edc8", "value": "768:SFmfGYA/lVONvWu83jTwQQwQ986u9MAHlNKqLSA/3Umq3725lf3:S4fGYA/7d1fwQ026u9pHveAu25x3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644309611, "uuid": "b9a761aa-b3f2-4281-b3e2-f3ccfd49bc57", "value": 43240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644309611, "uuid": "fa93ad11-69e7-4ad4-8185-8d6afe589def", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644309611, "uuid": "c45abe68-3208-433e-a2ea-747e4b19c5a7", "value": "02d3a54cfa60acdacc1d6b249c0d48b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ade1aa-88a2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644299404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644299404, "uuid": "4f9d2a9e-f940-444c-b871-8018896d4ea6", "comment": "Malware payload (Heodo)", "value": "73393609676db62dbe22d579c1b6d53e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644299404, "uuid": "541cd9b0-4823-4ef7-8cd9-de258e6ef0f1", "comment": "Malware payload (Heodo)", "value": "1b62a4fa79c89f6ea1267adfdd40c52ea8b7e8ec7a728d067b782124fbfefe90", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644299404, "uuid": "cb45ba6d-f7ed-4b5a-8287-db73b6ea7a64", "comment": "Malware payload (Heodo)", "value": "1e7fac818b2d782a27079ce656d24957a49cf464", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644299404, "uuid": "6f5ef2b6-1755-4c4b-a31a-6a4c2f14973e", "comment": "Malware payload (Heodo)", "value": "53644b9a06dbd161faff38cefb8d5de865e821d2ce18d10fe29fd0293a53656b669b4727d6ceacc46f8bb2752b18a9da", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644299404, "uuid": "951d58e3-d0d1-446c-bccd-7d12298c068c", "value": "T1ABD38D6EBA48CA0BD94913314EE7CBF67336BC819F5297473295B72E1C3A590CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644299404, "uuid": "69f1ff51-8822-4b66-b273-393dbbca1992", "value": "3072:hcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa31:hcKoSsxzNDZLDZjlbR868O8KlVH3skew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644299404, "uuid": "158dfc97-95f5-441e-8284-af1d07f636e7", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644299404, "uuid": "0610f2f7-1486-43ef-aaa9-008a56241391", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644299404, "uuid": "c211e0d9-f78b-416d-81f9-f02b2d68b410", "value": "tmpiw308uhw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d29904-88a8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644301919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301919, "uuid": "613ed4a9-dc9d-4313-92f4-7f6923febb2c", "comment": "Malware payload (Heodo)", "value": "7039bf264138fb13eafa9ebeb9af5201", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301919, "uuid": "8ea01a70-3fdd-4607-ad59-0b13b0764efe", "comment": "Malware payload (Heodo)", "value": "1b670241110d8a7d13c62187c8bdfd941841db59fc4044810728bcae10f42346", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301919, "uuid": "648a206e-a67c-4368-ab4a-486463473957", "comment": "Malware payload (Heodo)", "value": "1fdba0f603d36ac705cc44d8631a56ae5806eb43", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301919, "uuid": "e207dd02-3358-47b0-953c-779b31e87965", "comment": "Malware payload (Heodo)", "value": "2bc4182663af16f4ef468ffb514707cd5187a1b4af9c90fcb70886bc30a57f6fbdb63c1cf3da10229eb79bceb89c7137", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644301919, "uuid": "fffa9970-ba33-42e8-9fb5-722da21ea430", "value": "T18AD38D6ABA48CA0BD94913314EE7CBF67336BC819F5297473295B72F1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644301919, "uuid": "5dc2e136-1e37-44c9-b28e-0c3b3f014d05", "value": "3072:rcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3I:rcKoSsxzNDZLDZjlbR868O8KlVH3skeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644301919, "uuid": "382e236a-2599-4b17-852c-49af42e49910", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644301919, "uuid": "e682a928-5edf-418f-a382-e6953c7ab4d1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644301919, "uuid": "4d12629e-1611-46f4-ab7f-5f41970cf2b1", "value": "tmpvdzt8kzw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "536e1f3c-88ca-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644316310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644316310, "uuid": "2b9b19a8-0019-466d-a528-8d18c79b943a", "comment": "Malware payload (Heodo)", "value": "1b95fae3207c3afda1c78d367636e283", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644316310, "uuid": "22619ddd-86c3-44f6-8941-1e5e361ba2ff", "comment": "Malware payload (Heodo)", "value": "1b7a7901b061041c03a45f5bd98430bc9a5acc4ebcfdc5f07ee4e6d56e3162b3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644316310, "uuid": "86a7d3a6-7eeb-4937-b15c-de88fe19d62a", "comment": "Malware payload (Heodo)", "value": "faf56e1b605cada2185aee2c8580c6536dcbb4a0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644316310, "uuid": "6f5c86ed-f8b9-4612-b203-6e316ae78e2f", "comment": "Malware payload (Heodo)", "value": "0492205226ec275853acb1881db8661a9025b9fa03da6bff1b3212275b545ea6969394339fc2a9c6101d62d7074794c2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644316310, "uuid": "e7cf0c50-998d-4839-92c5-be37c9e326c2", "value": "T1A293499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644316310, "uuid": "34319f7c-9bd5-40b9-b4b2-b0c3fb4af271", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644316310, "uuid": "833e3bc8-a26f-4aaf-9b52-997935b4eebc", "value": 96732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644316310, "uuid": "1c036494-5223-43fc-aa89-7b68669d249a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644316310, "uuid": "4f990eda-ab7b-4ff4-a740-e2f36b2caffb", "value": "tmpk3glofpr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac1e983-8939-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644364158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644364158, "uuid": "c109f2ff-cf10-4ae8-9726-36b88809474e", "comment": "Malware payload", "value": "720eff66b2c7df213ff77da4adfe5a52", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644364158, "uuid": "f0edcb21-dfdf-4f0c-8d0d-f1d983edefbc", "comment": "Malware payload", "value": "1bc1888e905db4bf78bd70e59ba6aa6f3205ea54a370574f8c785667d133567f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644364158, "uuid": "fe53b4e2-eee1-49ad-98b3-869a14aec732", "comment": "Malware payload", "value": "f9e486f3e7a95617d702e6957aa8db74f43822b6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644364158, "uuid": "ad72b6be-9ede-46e1-a0bd-ff09d5cae72b", "comment": "Malware payload", "value": "564c786b821f61f4ff88af2892e0dfda3801b775362fbd8dbfb4b43495b6580a511b12a04821c5ff19a47dd80e666417", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644364158, "uuid": "5a9eb88e-3701-47ac-b408-169b0a19d83a", "value": "T1F2C35A55F685EA1ADE0822350DDFC7F9333ABC828E9683473299B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644364158, "uuid": "1d67cb58-e579-4d11-a37a-d7c43496aab2", "value": "3072:NccKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBx:ScKoSsxzNDZLDZjlbR868O8KlVH37keZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644364158, "uuid": "77393462-492d-4c05-b3e7-944e7bdbddbf", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644364158, "uuid": "aa90d44c-86f2-4633-887f-186c1608a3be", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644364158, "uuid": "5ead0614-c364-4579-8132-913c5ebaa743", "value": "tmpceueccda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b273f9-88f9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644336495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644336495, "uuid": "29fc92cc-f053-4a3d-90d4-d8b9a3fd504b", "comment": "Malware payload (Heodo)", "value": "3e517ee8e8e26873a17d52c90e15a5d6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644336495, "uuid": "7277eab3-8e54-4348-a0e4-1db207fbf5b8", "comment": "Malware payload (Heodo)", "value": "1bc7610989ad076801f6a0294c1aeca7dcfc6db3ba9f66833a1496a6e7ddea5d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644336495, "uuid": "6b4fae4b-2b81-455f-a9db-c8b0aeb68120", "comment": "Malware payload (Heodo)", "value": "5e0528c9caee2f01a3d7d7bc9349733d3243b6e6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644336495, "uuid": "38b6f89e-20a0-437d-a7b5-3883cc4c7aca", "comment": "Malware payload (Heodo)", "value": "26e923f05b038786faf3c21d1faccc992555076f9f37849fd23ee44426618b12d2e7b86f47cf83ae9f5ecba0aa08b82b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644336495, "uuid": "87b73b7e-7560-4436-96cd-54c079a2d83a", "value": "T163C35A55F685EA1ADE0822350DDFC7F97336BC828E9A83473299B32F3D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644336495, "uuid": "96f58b6c-a424-48df-908f-f0bf0dd3f7b1", "value": "3072:zhcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dg+BQ:VcKoSsxzNDZLDZjlbR868O8KlVH37ke1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644336495, "uuid": "48ac32b3-61f1-4254-8184-c05db45fb1c2", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644336495, "uuid": "cc47a54d-c420-4f78-8b3c-a60e041f5e42", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644336495, "uuid": "449b2b8d-3224-4c38-ab27-70f4b3d3f141", "value": "tmpdd9altr1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e0e9d8-8881-11ec-9275-42010a9c0029", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1644285117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285117, "uuid": "90cc54c5-c445-46e2-97ea-cdb7c3f6a9f6", "comment": "Malware payload (Gh0stRAT)", "value": "ad24222703f37e3af416fe87a6ebceed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285117, "uuid": "27a50e33-cd57-4ed4-b800-031305e45a2c", "comment": "Malware payload (Gh0stRAT)", "value": "1be5d77699275e27b8e36baeae94c4c26ee47fcb54c66ad2dca6476b471c9800", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285117, "uuid": "c13a8013-f3f6-4dcf-bea8-3531ccf391b3", "comment": "Malware payload (Gh0stRAT)", "value": "23590845a98478849cc593b727aa68d4cedae8cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285117, "uuid": "d14356d0-2fb5-4d8a-a887-326addf23194", "comment": "Malware payload (Gh0stRAT)", "value": "e4e49a49ba4e599933602df1670d08a0fb50bbf515f6af877c916eab2eb7dd8f23631d9f00f28c61b20fa7ef7b72e647", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285117, "uuid": "2cc5cd2a-202e-4fcd-843f-b76edb35448d", "value": "T10A15E643927F0366C8C921309F75817AE8F4AEC2A0D6ED19EF90DD8BC53A3912959737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285117, "uuid": "7e6cd231-3a7b-4b0d-850e-6e5355414847", "value": "7b07cc4fbd0f64cf4483f550092ccf47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285117, "uuid": "ea12d065-0281-41d2-9ee8-cc45a7a7cf4f", "value": "12288:TXDJlAghv3r+TsP9EtWhpjiAbATMM5JceP:TllAghv3r+TsP9EQp2A8MM5Jc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644285117, "uuid": "005f8d65-ef01-4ee8-a082-bf1efcd1929e", "value": 901751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644285117, "uuid": "652ced22-c1cd-406a-bf52-cfdefe941eba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285117, "uuid": "f0457db8-f6ce-47d2-93c4-9da1e8a1e255", "value": "ad24222703f37e3af416fe87a6ebceed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f6515d7-8912-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644347173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347173, "uuid": "06ca023c-0f20-42fc-bf27-22e077833683", "comment": "Malware payload (Heodo)", "value": "8dd79ef8031a780dbba1bbd919e46932", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347173, "uuid": "77aba84e-2873-4c2c-bdba-d46fbcacd4e5", "comment": "Malware payload (Heodo)", "value": "1bfa5718d2ad5015fb4ba64602291a4bde2eb0fd8ba7564e18b2a9b6060512f6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347173, "uuid": "5b482b8b-aec3-4e48-8b26-3c1f1e686eab", "comment": "Malware payload (Heodo)", "value": "bd2ddf256b3b0ad80950961040308cc4d02a811a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347173, "uuid": "e0ff30b9-3d14-4ff1-a81d-0ff2022f33d5", "comment": "Malware payload (Heodo)", "value": "108b992b40fc7dfe315fb96ec2c5e7a26d61d012a89f4a788318a1c8dc459487d09a86b6c123ab8aa01adc0081c24e09", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347173, "uuid": "e5850b81-f92d-499e-b3a4-b797581652ab", "value": "T175748C41E952C03CFEFB00B9D4D6C62AAD1E2E211B9D569F6244366D36603CF163F62E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347173, "uuid": "65a36b64-e3de-4dfa-ab56-a5a58a643e79", "value": "79fb40281049052b3e354a6e444da473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347173, "uuid": "25767dc4-422e-4569-a8bf-a4234f55efd7", "value": "6144:YFF10hIGpvweY+wBuBqtrgummwYT4ahREWkOieUR6:yKIG5FEnmGcKS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644347173, "uuid": "58893557-6e38-4327-8e3d-87450fa25ca0", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644347173, "uuid": "7fdcf669-8755-4fcf-8bef-51a9b1c05809", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347173, "uuid": "eb750f90-2157-4e2f-b3ac-481bc440565f", "value": "emotet_exe_e5_1bfa5718d2ad5015fb4ba64602291a4bde2eb0fd8ba7564e18b2a9b6060512f6_2022-02-08__190604.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19da2c0-88a2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644299261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644299261, "uuid": "97b856b6-70b6-43c4-b5b1-4af3c760fe01", "comment": "Malware payload (Heodo)", "value": "dd22c0b71c3920f87d4f45c8a24b85da", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644299261, "uuid": "eb73da43-462c-411a-ad44-0a6e2fdb2d61", "comment": "Malware payload (Heodo)", "value": "1bfe62e58de2eb373c27cab204995aea450345f1df5c10ca30276ede82ad8c05", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644299261, "uuid": "1c9b8597-2937-4fd3-918d-0166a0e0b7cd", "comment": "Malware payload (Heodo)", "value": "6fdaf11d687f995d46affde0d51e040b74255f19", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644299261, "uuid": "2fb274a4-bc5f-4852-9d33-35d364952cf7", "comment": "Malware payload (Heodo)", "value": "199e2689c665ecde1592f486f784df7df7503a8e3460de108c8e124041467897e057f113435bc47b69d0e9b1931c98a3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644299261, "uuid": "e00b880a-aec2-414d-8d10-2d3ed69ff0e7", "value": "T174D38D6ABA48CA0BD94913314EE7CBF67336BC819F5297473295B72F1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644299261, "uuid": "e20ddcd0-0f9d-4993-a085-24d083f52206", "value": "3072:zcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3y:zcKoSsxzNDZLDZjlbR868O8KlVH3skeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644299261, "uuid": "6bac96fa-6e12-4317-b355-325024ab6d0f", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644299261, "uuid": "323c0d3e-3cca-466f-8f29-889dc18a5f13", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644299261, "uuid": "d58f44de-2db0-4890-9d5a-1be753bd63d9", "value": "tmpogj0m3ue", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "643c0e7e-8880-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1644284556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284556, "uuid": "4987b812-8a8a-403d-a213-90691fded277", "comment": "Malware payload (DCRat)", "value": "8823bfc9bd6494d9fc2e0169fc140c0d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284556, "uuid": "d9e47a98-aeca-47c0-bebf-b2f49b62fa57", "comment": "Malware payload (DCRat)", "value": "1c43bf7b6bd40a3f88d1156b87c3ae81bc312c357d9ef30ea92d6bb0b462deae", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284556, "uuid": "6d0d4a11-7623-4706-8d04-2dcd93da9518", "comment": "Malware payload (DCRat)", "value": "c038d9e9be18d62c2403f59f8a1b62550be2eb04", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284556, "uuid": "d74972fa-1053-46fd-b783-1dbd2fbc3fc6", "comment": "Malware payload (DCRat)", "value": "d9d1ae3030b33e8b5a3c76e043c1a265ec8b38bd475003f7c0ff03979fdfd18acaf9526938cf94eae3f67bdad4bb9c21", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284556, "uuid": "da04b5cb-d102-4b22-8bca-4e69dce93b18", "value": "T1FE54ADC13690D873C4923E71A425CBE05A7BB976DA209607F778FB9E2EB03D14636352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284556, "uuid": "05ae5f19-c260-4344-99ee-1c4c3829cdb0", "value": "a4da89cf7279b64e418bdf5c01100db9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284556, "uuid": "ea044a11-0e87-4ef9-b8a8-5b8ff94dec9e", "value": "3072:0no2BaY3l37DrC4u0xgRB0QpT8oMbVggjcGkNIVqIjsxkgaBChLuetdSLQ:0nZaY3B3/8eQJC7ITsqzigabetdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644284556, "uuid": "a000fef6-9d5f-40bf-abfa-22a0b9849270", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644284556, "uuid": "f3aa9aa4-a9e8-4e7a-b817-a54929685b7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284556, "uuid": "0b6d3da6-fd14-42e0-b2d3-6849e7fc22db", "value": "8823bfc9bd6494d9fc2e0169fc140c0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c93af75-88b1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644305454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644305454, "uuid": "a208f637-c1a7-4832-97da-eda3dab82ee1", "comment": "Malware payload (Heodo)", "value": "90e9c5d59b7e4113f4940355198cbab1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644305454, "uuid": "f331bc6e-8e1b-4660-ac66-c3d6afdf0f88", "comment": "Malware payload (Heodo)", "value": "1c62321d9325b458397fb97605f4e6ffe6de54854b2eb6117e68d9920b654652", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644305454, "uuid": "8b8bbf5c-7182-4acd-baf5-f6009473c9d9", "comment": "Malware payload (Heodo)", "value": "de37a93c6720ce9fc8642355c2d3c70980b86a9a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644305454, "uuid": "48193275-602f-43d9-bf05-d3101838eae3", "comment": "Malware payload (Heodo)", "value": "5a461ee2902f7a99e53e1d2d18eb975894b4c5d1cc178a0a970177a77e88139f4d0da71617e089af9eb9580e509cd0f9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644305454, "uuid": "0db5bec8-9226-49f9-802d-41409eba9b02", "value": "T10493499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644305454, "uuid": "dcfa01a0-f0c4-4653-a21e-8ce2ca8fbf75", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644305454, "uuid": "14d5c3ce-e0eb-462a-8a2d-2923322b291b", "value": 96338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644305454, "uuid": "32b59fb2-5f9a-4fb3-b4f3-8a872972919f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644305454, "uuid": "ea937566-b8d9-48e3-a373-ee3c8de34c50", "value": "tmpg6hcej1v", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cfc8c30-890d-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1644345076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644345076, "uuid": "0f5bdd35-2508-45ce-b15a-026a7d19f034", "comment": "Malware payload (Amadey)", "value": "e7430a3285f1cc9d35cf2c9685211568", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644345076, "uuid": "8a58cdc6-246d-4b26-9512-1551537f69ab", "comment": "Malware payload (Amadey)", "value": "1c783c06aa669b0133618672069fba39409a6eda891e48e172d679ed0c1e8fef", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644345076, "uuid": "f2d3c5cd-88fd-4566-8ce0-e257fb4eff84", "comment": "Malware payload (Amadey)", "value": "77193df3f0f769aae0476b18d50a7d337e839d6e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644345076, "uuid": "a9823711-97a7-4687-8eee-0ed260cdd4af", "comment": "Malware payload (Amadey)", "value": "09ea32d03b73d9c0550270b6b6d27f35583090cb9d94e7f6aaafbdd07fc2274cdad36bdf17adbe6a873eab0730298761", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644345076, "uuid": "f683319b-057a-4c4f-8ce9-c71362814fe1", "value": "T1D9952800FA748724D59C7AF7C3DB689843F3A4C55F71DA0EB25AA7B12942A53AC4B30D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644345076, "uuid": "028648cf-1aee-4f80-a93e-aa470546b96c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644345076, "uuid": "01cfea10-21fd-4193-908e-0ccc7de2203d", "value": "49152:40D2TcqQuBwbhIhyp75qpyqcN3fyqTLORbwpYeRwlRgWTUU0PgItqKEEfADVRkMU:djaY70ujrjtLWK10q2qc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644345076, "uuid": "f0ed3247-32bb-4c3f-a74f-696fbb658595", "value": 1974272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644345076, "uuid": "df43545f-7055-4cfc-841d-6686ccb28a6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644345076, "uuid": "fdea97ef-1be0-4885-a534-90ceaa1f4506", "value": "e7430a3285f1cc9d35cf2c9685211568.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261e57d9-8913-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644347587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347587, "uuid": "8ef76687-564f-4b6d-a82f-54037e2e85dd", "comment": "Malware payload (Heodo)", "value": "480d806d35df65be276f5a199e29a05f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347587, "uuid": "e7d870c2-de6e-42d1-a741-99270c428c8c", "comment": "Malware payload (Heodo)", "value": "1c87399ac929d104d94efc465046bc2fc28985d0a63d34c130551da86368d0e2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347587, "uuid": "aee3e666-b045-450b-ba87-10da57b7a1e5", "comment": "Malware payload (Heodo)", "value": "3b613b0be903e060e75bf82fd1d3f2d2a136554f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347587, "uuid": "1fa257ad-871c-431a-bc93-495faa013cc3", "comment": "Malware payload (Heodo)", "value": "48d565c0b877541bdea0af4852d38fd5086b0bd80363be5a7d2f6f23319feb2648750af927a4aea92bbc460ea72a16f8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347587, "uuid": "38b35393-1bd3-479b-a8a3-9bbe53a05a26", "value": "T156C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347587, "uuid": "e0dd9777-0409-4d94-8e1b-448d8d8cae0a", "value": "3072:X7cKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dg3Bd:rcKoSsxzNDZLDZjlbR868O8KlVH37keN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644347587, "uuid": "4ab2611f-1865-486a-ae2c-2dd1f65c9f7f", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644347587, "uuid": "ca6aca15-9755-453c-aceb-d4e03b116754", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347587, "uuid": "4fb86631-dd8d-4ac5-b264-2563e77d6ce7", "value": "tmp7jqetsz3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e566f6-8916-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644348933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348933, "uuid": "55a59512-a0b2-447b-9491-9f9a6d9ec16c", "comment": "Malware payload (Heodo)", "value": "c6bc623a6a27a74b22692e7eeef3942e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348933, "uuid": "1c87f800-9000-4055-b8a5-3573248850c2", "comment": "Malware payload (Heodo)", "value": "1c9799e97b82047585460a8f264bbd6284822fc534942c8a392586e145daa486", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348933, "uuid": "fb54fde9-4528-4d17-bfec-5b0a2c441515", "comment": "Malware payload (Heodo)", "value": "4f07380aff64366d45b4ed9be605ae27ae431b07", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348933, "uuid": "866f5aff-ae44-404a-895b-41fefda87240", "comment": "Malware payload (Heodo)", "value": "f9dfc5f8eb6d16121780b2fc1c998d37d4916029d7b36570f34ec86fece2d5d29890e021ec63f2100bcac9c07b365aa9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644348933, "uuid": "9f651a48-52b3-42f1-bef5-edded759191d", "value": "T1E0C35A55F685EA1ADE0812350DDFCBF97336BC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644348933, "uuid": "8056f21b-1cc3-4d84-b4e4-1a02e4de3026", "value": "3072:ZAcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBD:icKoSsxzNDZLDZjlbR868O8KlVH37keb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644348933, "uuid": "7e7140ee-79e4-4a90-88db-ffda236a8143", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644348933, "uuid": "8a29af78-2d0b-42e6-8c61-c3747688775c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644348933, "uuid": "95e6dffa-b1a5-4792-8351-1de11d99e026", "value": "tmpf7bk522a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8541c3-8924-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644355064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644355064, "uuid": "6a3e32c6-5e5c-42cb-88dd-4c2df3b9187d", "comment": "Malware payload (Heodo)", "value": "b7e926d971a1ed6a414c796ede30ab86", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644355064, "uuid": "8e5360b0-9826-4a9f-9e82-df8a7e802c3b", "comment": "Malware payload (Heodo)", "value": "1c9bfb7b21dc0e3ffecc929b2ff06676f29a44476d267f18353f4b3110416c15", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644355064, "uuid": "48701b2a-fc47-44f8-957c-0d7de67c55e0", "comment": "Malware payload (Heodo)", "value": "36680fc172d87a1f95ffa7b8c6ac0b38e3c0b47a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644355064, "uuid": "cfcab540-1c0e-4d91-be17-b7d6c69d7d3a", "comment": "Malware payload (Heodo)", "value": "4c644f097206aa7f5226a3f29558b9c7eb612864f8cac97530827680ed81bfbf120631d362c2ecbb7054ae323b6b8ee2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644355064, "uuid": "87aa35ca-48ab-4e7a-a57e-f37f4158e218", "value": "T15AC35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644355064, "uuid": "aa35beb4-7483-47ae-8d56-e7e06603f4e9", "value": "3072:XKcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBO:acKoSsxzNDZLDZjlbR868O8KlVH37keW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644355064, "uuid": "c33a1330-450d-4203-94cf-2d9c1e20f7c7", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644355064, "uuid": "2522fffa-31ea-4027-9934-665a296ea4ce", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644355064, "uuid": "1f1f268c-1f5d-48a0-9c15-bec2670a4abd", "value": "tmpa4f7r4m3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9768a920-88b4-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644306975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306975, "uuid": "87248204-793b-4e1e-9a07-b16ee1648982", "comment": "Malware payload (SnakeKeylogger)", "value": "6951101bd3dfa62b5fb19e6c79c4a501", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306975, "uuid": "aed2cd41-803d-4f85-9cfb-457feae8eca7", "comment": "Malware payload (SnakeKeylogger)", "value": "1cad930328dc809e2e13ba5620d7d087faa1a55687950a72fc02fc050cf26a25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306975, "uuid": "d77b4d7d-6aaf-48c5-a78a-ddb0d64b3c50", "comment": "Malware payload (SnakeKeylogger)", "value": "1d835f2346f223fbc9f97f3017e4aa5b4f46cbde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306975, "uuid": "2c13b05a-9d0b-48cd-a1f1-494b32f40040", "comment": "Malware payload (SnakeKeylogger)", "value": "290c642c175dc18fe70e4f940c27628ca923fbcc0d8a6c4ab5e84ee0d64244fa68004e4bbec316b8a7af61416c2acfde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644306975, "uuid": "68bb513e-cebb-4b49-9d5b-2cf392ebcf48", "value": "T157E4015A60E1E112EAE5713C8FA2C1350376ACC8A843471E6BE97F5F34FD2D719122E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644306975, "uuid": "e42e99e3-f802-46f3-8df5-4b42963466b6", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644306975, "uuid": "33c5e8af-e61a-4c45-be92-94ef972fd1e8", "value": "12288:qFyoGmyLzOOXirzQzF5rQFuprMZxfcdVGGDKrOx60LMuEG:qFWfhJF50FuprMZx0dV5DKrU60Y7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644306975, "uuid": "16f52aed-b3b7-4383-9f5e-1a1235d05857", "value": 716412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644306975, "uuid": "a5be6f60-1fca-4ff5-a751-5174be2f6c6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644306975, "uuid": "89d12697-2854-47f2-acae-b7248c3d3961", "value": "09876543245678987654567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f479cef1-88bd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644310997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310997, "uuid": "9af44ecd-0e69-463c-a892-bc405619bc5a", "comment": "Malware payload (Heodo)", "value": "11715d01170965a20fb291562c091681", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310997, "uuid": "9439abe7-1caa-493f-b285-53c26ffe8d0e", "comment": "Malware payload (Heodo)", "value": "1cf188ef0a886198142a0f4cfc58b0f8633065da211ec87bd2915e1a2cb6ecc8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310997, "uuid": "443b08d9-7eb9-40b8-a1ad-bb3ad1ed0c32", "comment": "Malware payload (Heodo)", "value": "d313c1c50201e9bd9f34e55d142abb58cea5fd2f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310997, "uuid": "a6374ce5-d535-428b-a65c-0e8e40271f2e", "comment": "Malware payload (Heodo)", "value": "6b338c8d87228f950ab489498a3337344fd82ab49273d308380b5b6a7832ea5b1bccb4ff3ca3afeb258892d84f05dc5a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310997, "uuid": "dfa81a5e-3e42-443c-833b-1f146b5ae724", "value": "T178C36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310997, "uuid": "75e3e36f-414c-40bb-8359-3ab47a450c85", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644310997, "uuid": "71ffec6c-a075-4138-8fdc-f47421505482", "value": 127891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644310997, "uuid": "01fa5b01-be95-4cec-af0a-813cf36236d2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310997, "uuid": "189bc4d6-d3f2-4621-a31a-656e1ca3de36", "value": "tmp25q9wuo2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda7c778-88ed-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644331521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644331521, "uuid": "65e12a2a-4933-4c5c-a9d3-9cac227e89b0", "comment": "Malware payload (Heodo)", "value": "aca2b7300c316d490be26d3775f7d177", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644331521, "uuid": "d2d48c0a-49dc-43cd-81c4-8064311b0cd0", "comment": "Malware payload (Heodo)", "value": "1cf9999dc24608c25d3ce6bbf468a47298e9d58c08235910523fe76bc6e164a8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644331521, "uuid": "eca99c1e-8db1-4583-9ad0-32d6f4a03a5b", "comment": "Malware payload (Heodo)", "value": "7c0f9d7dd1fb2238e0e5f711f02783cb1c12a9a1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644331521, "uuid": "31c5a85b-725c-4093-b329-da83571acaea", "comment": "Malware payload (Heodo)", "value": "bc90f400617eb8f1b3093544175a47b9a3952cb44799b3e8f4ad5b4eba0305155b4e8e7b261b12cf27173a2242b07856", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644331521, "uuid": "7aa29f24-fe83-460e-9d48-ef4bdc3edb33", "value": "T1E7C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473299B32F7C76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644331521, "uuid": "3cc75d11-9b18-4f94-8575-a39c293e596b", "value": "3072:oscKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgcBb:3cKoSsxzNDZLDZjlbR868O8KlVH37keI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644331521, "uuid": "ad6ba33f-3b0f-4c5f-9980-b6ea7620708f", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644331521, "uuid": "98b55982-49bd-4e58-9b89-a3eba9d95e56", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644331521, "uuid": "f988a500-b009-4d24-b884-ecb2d9c17608", "value": "tmpy8c5aqc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "204cfd95-887d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644283153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283153, "uuid": "51de2d71-fe16-440b-a19e-b5f90c68572e", "comment": "Malware payload (Mirai)", "value": "ed9c49d4d3d026cb98b84d9976923dc1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283153, "uuid": "d27069ec-5e34-442d-972b-b03531a56384", "comment": "Malware payload (Mirai)", "value": "1daad30256f93388854daa83b7c40846e5e72038c69ea394933ffc407544f51f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283153, "uuid": "ea074fbf-d4be-4ff4-b0f1-3653c4f233b1", "comment": "Malware payload (Mirai)", "value": "69f1eee1f65ba27d736aa9d67b17a2bdf52b18f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283153, "uuid": "0c66e2e8-5070-46cf-b638-f9bdc51239d4", "comment": "Malware payload (Mirai)", "value": "141ea52f15897e689f4c6758a92e7e59f2843e3153a2a4d58ed58df0ef7c047ae4085f240047023ca8c66097fa5a9e4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644283153, "uuid": "c8022b59-8da6-4e2a-affb-24c34244b16f", "value": "T140636C31BE763E13C0D1A47611F78725B9BA53CA21E4C22A3D711F89BF54A106A13DFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644283153, "uuid": "436d391d-1c4c-48d4-83ab-8be8f27429de", "value": "1536:KLg7EQDUoHE3ElHOqlFTA00gEB0c06nfiV0spT:HbeguUEBz0zXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644283153, "uuid": "7ee27f26-0f9b-4529-b86f-becea5e639ab", "value": 67968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644283153, "uuid": "daf21d6a-785c-497a-bcde-0329c256d12e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644283153, "uuid": "e60c7131-a5b6-489b-99a4-f695876605c7", "value": "ed9c49d4d3d026cb98b84d9976923dc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe1b8fb-8882-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644285615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285615, "uuid": "d0e46596-5c7d-4e9a-bb13-ba391346cf73", "comment": "Malware payload (Heodo)", "value": "98739d4a0a282e1a91aea7b0fb72ad4f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285615, "uuid": "ab92550a-601e-4e65-945f-cd9f886bf793", "comment": "Malware payload (Heodo)", "value": "1daf42e68cd26c35cd7857f502ac861d819586556b10edbb71883e2e38777ce1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285615, "uuid": "9f442118-8e2e-431f-8167-74a37b080fd0", "comment": "Malware payload (Heodo)", "value": "cf315cded3c661d51c4ba39e618b8b4869eed2d5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285615, "uuid": "b0fbfa00-3b38-42de-91cb-bb9eb30d479a", "comment": "Malware payload (Heodo)", "value": "c794cf1fca2f16ed20203f18386ac697f34129b21d3c5404cfc3d76f7a54e19eb51179188163fe22b10fed229a4f90e0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285615, "uuid": "45c07cbf-097d-4b8a-afb9-a362ddf8b4a6", "value": "T12ED38D6ABA58CA0BD94913314EE7CBF67335BC819F5297473295B72F2C3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285615, "uuid": "240e6bab-481b-45f1-ba04-f614c9549936", "value": "3072:/cKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgDa3U:/cKoSsxzNDZLDZjlbR868O8KlVH3skeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644285615, "uuid": "eeca31d6-5475-482a-94be-63681c9c5068", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644285615, "uuid": "e7fe958b-e20d-4db2-a701-98c0ea1cbff1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285615, "uuid": "1a17b3c1-2541-409d-bc55-d635c9c0df04", "value": "tmpdhwj9_7q", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ede235-8903-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644340987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340987, "uuid": "fa881925-f0c1-42dc-8ad8-df757d250bea", "comment": "Malware payload (Heodo)", "value": "73d2207464ab6dbdfcca7992c6c5b4fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340987, "uuid": "016c8df6-9abc-4ea2-941f-8eecd6b50c93", "comment": "Malware payload (Heodo)", "value": "1de7e277486a9504e4c02573945f252d14d743c8906762e187bf0fa644278a39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340987, "uuid": "6a361f5e-8f22-425e-aefe-ce9cbd590270", "comment": "Malware payload (Heodo)", "value": "a9947579e8f7d582eb879e6041fd04eda91a6bf9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340987, "uuid": "24cb4682-9d05-4cb6-ba1a-aa9d59877a27", "comment": "Malware payload (Heodo)", "value": "f6f692b3f5b900cbf85088e1e7757e7887ce5e0d81fad4494445ccb919e3d825289d63f545027683269ed028144a94db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340987, "uuid": "a072cc1b-6bf7-4671-acce-241f734f1a47", "value": "T1FF848D06E652C03CFEFB04B8D496CA66ED5E3A24169D619F63413A6D32613CF123F52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340987, "uuid": "87d0ebea-2bc1-4ce2-8cd7-1f88942db77f", "value": "79fb40281049052b3e354a6e444da473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340987, "uuid": "956954fd-da16-49ed-bc7c-ab1127fb6890", "value": "6144:O56dLjBFLyztOo/eYIjAmkB8lebi9JqGXdZ32mneM0laNUIbeURK46:YszuzNKjWB8f9JqQ2mnB0l4UMK46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644340987, "uuid": "ad63b28c-ebbc-4e4a-8610-cc10f2ce5244", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644340987, "uuid": "1476ca44-a40b-4488-92d5-a5464d5c7b51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340987, "uuid": "10adb58b-84f0-4a9c-bf85-7b9b9f994028", "value": "73d2207464ab6dbdfcca7992c6c5b4fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ff5ba8-892d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644358781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358781, "uuid": "faa3a773-bece-45dc-b0d2-e31ced8a91d3", "comment": "Malware payload", "value": "daf67e0ee92f9eb7624c35c6781c85fe", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358781, "uuid": "4f3f9998-ca19-4a87-a1b6-e2b5c94076c1", "comment": "Malware payload", "value": "1dfe51842951068393ba9d23803d3c4cc3a2af15d0f24df2ff3814b5b6618cf5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358781, "uuid": "ade1120c-a690-4ed8-b2c8-4eb444e1a91d", "comment": "Malware payload", "value": "4f9aebeab494d5f17a05985ae3793b47103742e1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358781, "uuid": "2ddb7a0a-ac1b-4172-8017-23b9e2f99bf6", "comment": "Malware payload", "value": "e8a974593e0aa24af64bad77d6e4becdd627ec2f008749b40f232caa3db294695f3da319247ae2771ee33ba1fb76b748", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358781, "uuid": "3f95a713-6d98-4de1-aa0b-22a23bf14084", "value": "T1E9C44B13E68398F1C79C803973AD7BFF802A155547E876D30BF1858869AC0E14BB7D9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358781, "uuid": "759b3bf6-0121-4aa6-bbe1-411a980a6fe0", "value": "1059dec3a72d4c311e39c8fc33d5af98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358781, "uuid": "48c40b7d-2919-4edd-9a9e-d2d1b83be133", "value": "6144:/mbbvqXJery1jH9OttfeRdq9r8BVBALMaXvc9e8h2qYJVwdFmFlE/S:QbvqX4+eKdq18mLRXieg2jJ0F9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644358781, "uuid": "3758dc63-1048-4938-9bcf-01488a7f3376", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644358781, "uuid": "4bf5a238-16ed-442b-b419-a23a85a3614d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358781, "uuid": "02f7d842-2103-4f7a-9728-2eae1bf02cc3", "value": "emotet_exe_e5_1dfe51842951068393ba9d23803d3c4cc3a2af15d0f24df2ff3814b5b6618cf5_2022-02-08__221927.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27f938a-88bf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644311718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311718, "uuid": "41d601fc-5bb3-44a6-bd52-003c1bc1dedf", "comment": "Malware payload (Heodo)", "value": "3ac59cadf912876defe64edf20936209", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311718, "uuid": "5078e6b5-0dfc-4548-9631-2416b15b4adf", "comment": "Malware payload (Heodo)", "value": "1e9e51cfbead14cccd270f344dfe7e848f92ab43f4427485f81b6531d2bd1515", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311718, "uuid": "d07cd30e-0f7d-402a-a561-97266b24ad2f", "comment": "Malware payload (Heodo)", "value": "70cd4051a704aeb8444890a40602b68961582744", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311718, "uuid": "1d7141a6-c1d4-41bd-879a-5d82a84fd900", "comment": "Malware payload (Heodo)", "value": "801ce5557a062ad0c99eded0b9b0f1af66e502e7359455c962385dff8efc96dce9780914d5b7fd61b208db68195ad0d0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311718, "uuid": "9a2a5873-567e-4ac6-bed3-1a9afbe81b13", "value": "T13BC36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311718, "uuid": "5bb723cc-78a7-464b-86d3-0f514690a7bc", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644311718, "uuid": "7759584c-0cdd-4f7d-a751-97f5546d733d", "value": 127944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644311718, "uuid": "cf6ea22e-dd8f-44f9-9bf9-913e74d5403b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311718, "uuid": "c09ccc55-8ac7-4ec1-be09-2112d65ac40d", "value": "tmp38sxmk6n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e197049-8898-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644294746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294746, "uuid": "2c4b2d64-34dc-4f59-ba7e-6ce7a53c7e33", "comment": "Malware payload (Heodo)", "value": "20a72fb4ad92d9d22e62c76e3109a378", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294746, "uuid": "3b98c665-ca5e-4bd9-a853-9bf7ab41395b", "comment": "Malware payload (Heodo)", "value": "1f0f2df44d1750e267e7a7a7ceeaf30c508cc84e5f607e14d1ba76a7d3ab4841", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294746, "uuid": "fb300b55-f497-403d-8d20-ef6ea62e2745", "comment": "Malware payload (Heodo)", "value": "e224562257a7bac88253c9c74d122fde24a375f8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294746, "uuid": "3384cb42-96fb-4b00-a2b6-c9d4141a9250", "comment": "Malware payload (Heodo)", "value": "800b111ff858c771cefb4416dadb92b44586de6433184d17a87a61165b120f2b5bf556a78c07147faf0499b30ed14277", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294746, "uuid": "607e226c-fb1c-4aee-a216-62877789bc2d", "value": "T18DD38D6ABA48CA0BD94913314EE7CBF67336BC819F5297473295B72F1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294746, "uuid": "5ef2b60a-755d-4d13-8b54-08ebdc60a886", "value": "3072:kcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3G:kcKoSsxzNDZLDZjlbR868O8KlVH3skez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644294746, "uuid": "d6865d42-67b0-41eb-980b-db3307c40004", "value": 132607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644294746, "uuid": "f57f7bd1-1677-42ee-a5b1-2c984712fb50", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294746, "uuid": "8aa93d70-b045-40d6-9838-fd5e07a10710", "value": "tmp09inf8ao", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f87347-88f8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644336155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644336155, "uuid": "ac8701b2-0861-4606-ac25-0d101d9a8e12", "comment": "Malware payload (Heodo)", "value": "994898b6f2ac9cb3d172f7b9b377e0ba", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644336155, "uuid": "c206b344-95ae-418c-9431-95910118515a", "comment": "Malware payload (Heodo)", "value": "1f6168dee8108137d5fa575f2ea934a16eb81b1214ef0ca3bb92c3d7901b086d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644336155, "uuid": "9c17d1a5-0f97-4fcc-98b9-6be4280e9d74", "comment": "Malware payload (Heodo)", "value": "7a8128bac2e592445ec9bd69a5e302d23ea1bc91", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644336155, "uuid": "15b3ea96-3665-4a6a-8a1d-cbc847aacbab", "comment": "Malware payload (Heodo)", "value": "511619f35b31bf73900c836ca135ae2385b1a48714c5901714b11365e008d554bb794bc15140b372d3433ccb58ffa543", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644336155, "uuid": "62068ca8-ebfe-459f-bd3d-66fbe9639da6", "value": "T1F9C35A55F685EA1ADE0822350DDFC7F97336BC828E9683473299B32F3D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644336155, "uuid": "73abbce2-ac81-4927-8986-c1ee9ffc2db8", "value": "3072:v6cKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dg+B7:CcKoSsxzNDZLDZjlbR868O8KlVH37key", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644336155, "uuid": "c7b71456-6463-4efa-a20b-ba8aa3f33409", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644336155, "uuid": "de7baf5f-e749-48de-b486-25a594d82e92", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644336155, "uuid": "07026140-eafc-4474-88da-a2cd78fb0e07", "value": "tmpddsvaosh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e54c537-8912-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644347172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347172, "uuid": "db5e5cb1-4204-4933-b68c-e4ce928dcc1c", "comment": "Malware payload (Heodo)", "value": "68121d4c206abc22dbf5e130c8560246", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347172, "uuid": "3e6a08ee-3b3e-4d97-b8c3-91f3cd76934b", "comment": "Malware payload (Heodo)", "value": "1f7c1a019f3be34f517448018f86e1d17d0aba1701ed3a3837507cb69412907c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347172, "uuid": "439ee062-4e74-4752-8633-41a64efdae9b", "comment": "Malware payload (Heodo)", "value": "f805d060dcbe010be5f10e50f3d0d5843baab923", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347172, "uuid": "6fe07a83-9bdf-4729-a799-bc3a6bdc039c", "comment": "Malware payload (Heodo)", "value": "6436ea57e7e8e18a68d149ce0c097944f2e115e43d5524206e51618a72a27d924dd615bf82393db4778d134af19c1d7b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347172, "uuid": "3831391e-3bf2-46b9-aafa-e1531d3876c9", "value": "T1A9748C41E952C03CFEFB00B9D0D6C62AAD1E2E211B9D569F6244366D36603CF163F62E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347172, "uuid": "963e41e7-ebfe-4dee-821d-381f902448cb", "value": "79fb40281049052b3e354a6e444da473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347172, "uuid": "aa1787ef-c351-4cf0-87be-0d23a2a08331", "value": "6144:YFF10hIGpvpeY+wBuBqtrgummwYT4ahREWkOieUR6:yKIG56EnmGcKS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644347172, "uuid": "ed64244f-0208-4cdb-a589-62eb2a487cdd", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644347172, "uuid": "4aab4c49-2136-4808-8e53-fe8577e0aefe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347172, "uuid": "5be6ffec-caf9-4572-ac7e-db84ec86cd4a", "value": "emotet_exe_e5_1f7c1a019f3be34f517448018f86e1d17d0aba1701ed3a3837507cb69412907c_2022-02-08__190558.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22efd12-8917-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644349513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349513, "uuid": "772c0778-2be4-49db-9e8e-e81b0da58e5c", "comment": "Malware payload (Heodo)", "value": "2d154c33576b75960f51c4c38a83abd1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349513, "uuid": "c3685500-ffb9-4337-b02d-942780eb86d5", "comment": "Malware payload (Heodo)", "value": "1f8fff94ff2a921b2a1d56f93ab4803a6bb947bbbf0d846cb118ca6d662af241", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349513, "uuid": "9d0d9456-c1a5-47fd-8b68-0d334f1205e4", "comment": "Malware payload (Heodo)", "value": "bb822a882794f7f36e18085024446a191a49e553", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349513, "uuid": "bc1a8ad1-882d-4257-b929-70072aaccf27", "comment": "Malware payload (Heodo)", "value": "08e97c3f48c5560a84d96e5b6a00b00dc35ddd2c662cdefe40514495fdd9fc75669233d35c1eac8fc59ceb74a38cea3c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349513, "uuid": "20e7bf2f-a3ef-4ea7-b2a5-3597b8c8e68c", "value": "T148C35A55F685EA1ADE0822350DDFC7F97336BC828EAA83473289B31F7C76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349513, "uuid": "1d599bec-9476-48bd-8823-24c425476223", "value": "3072:Z1cKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBT:fcKoSsxzNDZLDZjlbR868O8KlVH37keL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644349513, "uuid": "d815be8e-3d87-4537-9da3-a4ac17ad5822", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644349513, "uuid": "099cc64e-11e2-49be-8988-1db9f8c04711", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349513, "uuid": "273d0126-8c11-4615-a67a-84e15d403b9b", "value": "tmps56z_d9_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dcdf647-8912-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644347171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347171, "uuid": "5d6abf06-0129-419b-9a00-4adf960a3574", "comment": "Malware payload (Heodo)", "value": "fcbdf9ca0f40a4201f31d2f93f83d0d9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347171, "uuid": "29244ff7-83d4-4187-aa2e-2257816a69bb", "comment": "Malware payload (Heodo)", "value": "1fa7fc8a3c335c1586bac2fd424cb154bfd5a83a35c545647a5c6cbf0bd57db5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347171, "uuid": "4744e6d0-0e8f-41f9-8094-eeac1551cf62", "comment": "Malware payload (Heodo)", "value": "a7103667ed31a8422b72b153f747630d28bc01ee", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347171, "uuid": "15dc94e2-9859-4fbe-985c-e9823c338a01", "comment": "Malware payload (Heodo)", "value": "70c71240a64a5a34c3862393202d49cee6092f42525b8d7082f7249b390fcb8681aca72d5700d58c11ae0302207cd67f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347171, "uuid": "d0da43b3-1d14-4d58-bc06-56d2a1ab8d68", "value": "T181748C41E952C03CFEFB00B9D0D6C62AAD1E2E211B9D569F6245366D36603CF163F62E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347171, "uuid": "66bbf4cc-afe1-48ca-b010-72e8ce11639a", "value": "79fb40281049052b3e354a6e444da473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347171, "uuid": "e10408e2-be3a-44c4-b160-ab5abe6503d8", "value": "6144:YFF10hIGpvSeY+wBuBqtrgummwYT4ahREWkOieUR6:yKIG5HEnmGcKS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644347171, "uuid": "c43d3afd-56cb-4ed0-9847-13759e6800ae", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644347171, "uuid": "a9d90dd9-079b-4747-a5bd-edbcc59090b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347171, "uuid": "2a82037c-76fc-4717-9afe-675b16d90b3d", "value": "emotet_exe_e5_1fa7fc8a3c335c1586bac2fd424cb154bfd5a83a35c545647a5c6cbf0bd57db5_2022-02-08__190558.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86687197-88ad-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644303940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303940, "uuid": "a630b918-ef82-464e-9809-eaf9b6c5a95b", "comment": "Malware payload (Heodo)", "value": "5590f40846dbaa1ecfc09ab547c7a8ba", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303940, "uuid": "6531aa86-56e9-41d5-8b6c-9c8a5115f38a", "comment": "Malware payload (Heodo)", "value": "1fb31a92c9405b4ac8331537ca1cab21b2875fcdd6430b43d2b99486982b85f3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303940, "uuid": "08ba36e9-a06b-4eb3-9a67-3a938d5a0870", "comment": "Malware payload (Heodo)", "value": "da2830ece270c94ae1d291fa2667b91b4c432ce8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303940, "uuid": "2be26a46-f5fd-4b65-ada9-da30aaa7df2f", "comment": "Malware payload (Heodo)", "value": "582edbe1b8423033784088ecb33539c86a7ae38d3842cada326dd6ae5356d33aba77e73e9f9bead2709a14f7115f6f46", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303940, "uuid": "4b47de17-5904-412d-b205-4402ed94a0fb", "value": "T1C193499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303940, "uuid": "105ddaa9-401e-4f25-a19b-892fd6e7be8f", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644303940, "uuid": "cd10b363-095e-4ef3-993f-22ac914dfd5f", "value": 96277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644303940, "uuid": "959a2b9f-195e-45ba-8b30-9f44bc9e40a0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303940, "uuid": "142cb831-6120-4fd1-ba74-6a7f799d1a96", "value": "tmpxfo2m3dy", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b20932-88d4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644320684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320684, "uuid": "4628ce19-ec29-4d73-b753-c20829d26310", "comment": "Malware payload (Heodo)", "value": "651db0527f52569022a87c2388ade0ce", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320684, "uuid": "4df9ba56-cacd-4791-af5c-8f3581ea3d23", "comment": "Malware payload (Heodo)", "value": "1fc1580bfb0c0c81bc9e916786beb79b7cf3f2b5cb38069c790843162e3709bb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320684, "uuid": "4a070b3c-12b0-4a61-86d2-58d8d769fd77", "comment": "Malware payload (Heodo)", "value": "973ac97022d526a74754fd81a229ba220f081f24", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320684, "uuid": "ea8dc5af-51d0-4414-91da-442819e38508", "comment": "Malware payload (Heodo)", "value": "1620f8f1f64875250b76d769fb32b01137edbff2b1219d6bcd6584e0077024f5059cccd57cce958483a70aeb4cc1b56d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320684, "uuid": "9a3b55ab-8970-4653-94b6-3ec13d247037", "value": "T191C43A12AA82B0F1C79C813EB3F97AEB903F146547AA76D34FB18C8965EC0D119F7911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320684, "uuid": "cd92d560-16cc-4b8c-aafd-3c6753a8cf6e", "value": "1059dec3a72d4c311e39c8fc33d5af98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320684, "uuid": "8a2378f9-4363-41d1-9a19-2e728188dd6d", "value": "6144:PQXvqLl4JINqB9QqbJq9AbuR/RzZ+fRTc96lnVPk5XtlOkiETHyROnR:oXvQDQVq9Ac5ZuR26lRkzloEzyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644320684, "uuid": "fe0bf919-99ba-43b8-920c-06a13c2cb8e0", "value": 596992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644320684, "uuid": "5a000218-49c5-4bd4-9f9f-399db8215ce7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320684, "uuid": "03558a83-5449-424c-b702-1b672a75b5c3", "value": "emotet_exe_e4_1fc1580bfb0c0c81bc9e916786beb79b7cf3f2b5cb38069c790843162e3709bb_2022-02-08__114432.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a7f299-88c0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644312198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312198, "uuid": "8456086d-9808-4701-b669-6f869c48dba8", "comment": "Malware payload (Heodo)", "value": "55d302e2aa6b666100be314bb55cdba5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312198, "uuid": "d59a65a2-f4a1-4b92-96ad-9c47d8808561", "comment": "Malware payload (Heodo)", "value": "1fcac08cf2ab7f5b8c170a94e05a2443f10205313ca6d5dba9852dbf9dbff9c5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312198, "uuid": "b485b4af-e92c-4737-88e3-e9e0e2cbc031", "comment": "Malware payload (Heodo)", "value": "b18b248ba7160c128777b7f1fa67ae35d795e3cd", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312198, "uuid": "c6209ba4-4f1b-47d4-b151-9818999e18f4", "comment": "Malware payload (Heodo)", "value": "2fa008b25f9151149f8cc781bb3d8b31980359246849c29a96ca2d3189f20c1d02fe28b3963d6ecb8899a12d2a12bf7a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312198, "uuid": "ddd7d426-9107-4737-b838-432eb0086ed3", "value": "T18FC36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312198, "uuid": "56e214f6-3842-47ea-86fb-a654c3b31970", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644312198, "uuid": "32909197-0efe-47c4-a16b-aac0d0e597a4", "value": 127811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644312198, "uuid": "60e6d55c-8ce3-4593-8f92-769b4f93cb3e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312198, "uuid": "635c379d-05bb-40ac-a1fb-e954b10607d1", "value": "tmpmgtp56sa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc823f9-887c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644282696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282696, "uuid": "4abb4efd-916b-4d3a-b945-b1e58be4c85e", "comment": "Malware payload (Heodo)", "value": "c21299bd73e0b7817e3336c9ad6e11fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282696, "uuid": "e0a29d29-5a1a-4c0a-aba6-af9920ecee03", "comment": "Malware payload (Heodo)", "value": "1fcfe46bcaf0656f3f9a355dc724c809245761f060fe0739d6b2b27aa9067191", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282696, "uuid": "26174195-bc5c-4f76-8285-58c3d0c036de", "comment": "Malware payload (Heodo)", "value": "ba2a12fcd3daf5580e80408cb39394bcf85007e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282696, "uuid": "fb68d5ae-62b4-4c47-adec-f73931ca4955", "comment": "Malware payload (Heodo)", "value": "eb86ef9657e34bda4f9a6d33974702c626f4ca23519a43ae331a9dde8871176374e1698c2fe3fe3a7d1a0c0665ef6a53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282696, "uuid": "da8d142e-a9d3-47e4-8c1d-be30e280e8e0", "value": "T1D6D429AB3A8FA1BDF17B017A6350FB44E4D27C1A9FBD25D70A86358893F2D054F18A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282696, "uuid": "c37b388c-85fd-4858-8230-1c23aaf17a94", "value": "bf1ebe22ec6f51f906ec295a3a5c6d92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282696, "uuid": "73ff9d76-5686-4a1e-b3a0-5f7e1a5195b8", "value": "6144:x42k6LwFPw91EDbkUE39P7pyADYzqlEDFmZ4s3wADwcvIpxUIVZFoEXlbeZhp4ga:x409qDb109PdyOYzq3u3fVbeFTi40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644282696, "uuid": "06449fac-b74c-423a-b34a-48418c9d3ce4", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644282696, "uuid": "d251a48a-b034-436e-af02-7f0a747944ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282696, "uuid": "603e4a20-a7ce-4ad3-b29d-1c11524a17e4", "value": "c21299bd73e0b7817e3336c9ad6e11fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74380e0-8922-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644354354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354354, "uuid": "e519dbb8-8870-4287-b2f9-6b65b2da23f0", "comment": "Malware payload (Heodo)", "value": "d4a7b40f84900c99ee6af7f5bc4fd202", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354354, "uuid": "5400d461-e5c7-4c90-a9db-bd54302823d0", "comment": "Malware payload (Heodo)", "value": "1fdedec31d1867ae5a1aa0943fd646c68030acac59f6d4b9d4456b4ed8c8bddb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354354, "uuid": "0df12ba7-618b-4726-a53c-7f674f069313", "comment": "Malware payload (Heodo)", "value": "7e1d299abe666b034321f464c9ff08bfa6fa9a33", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354354, "uuid": "978ddb20-3849-4909-89f7-74ffc1729d99", "comment": "Malware payload (Heodo)", "value": "a6dd55b5598873b5f0127977b18cb86c2d61196585381dc865a0a3c33a4fa9a659d751d009ac0faa4b45ce8ce29ae8af", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644354354, "uuid": "00418035-99b6-4a11-b9fd-d6fd3f3be73d", "value": "T1BFC35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644354354, "uuid": "126e6fe4-67f9-46a3-924f-a4a3590c698b", "value": "3072:apcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBN:4cKoSsxzNDZLDZjlbR868O8KlVH37kel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644354354, "uuid": "2cdc70c4-5b71-4b51-8a98-344f8f2b4b38", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644354354, "uuid": "9e5bd728-8316-4396-a3b2-bd858c4dbf47", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644354354, "uuid": "9144c6ff-3cf9-445d-af10-21a863cd8521", "value": "tmpqv2eyv8q", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815fba45-88d4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644320682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320682, "uuid": "c8b3c90e-fe04-4209-a54f-59540b2eef7e", "comment": "Malware payload (Heodo)", "value": "6d37a5681265473d64b99d5a6b6670c5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320682, "uuid": "2aeb56d5-9474-4059-835b-b7d417c13548", "comment": "Malware payload (Heodo)", "value": "200cbd5ea69a321cc367b8a9b6fdb77829f260c32a22b6f71038e0fd4f1f03d1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320682, "uuid": "a92755b5-1207-4f33-9a55-9df9483c5085", "comment": "Malware payload (Heodo)", "value": "ef411c962b42821f17be7d6d71ac6510a4244ccb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320682, "uuid": "9ed7c294-0f7b-46f8-b8bd-43a0a1ad65aa", "comment": "Malware payload (Heodo)", "value": "e0a864aff1e1f2196b10737ba0f360abd80c553cb6f98679031b31f645e53f0eb2b3eca00933339bc65ef3aa7ec3a276", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320682, "uuid": "8367cb0e-0057-4284-b5ca-b80dba57d158", "value": "T165C43A12AA82B0F1C79C813EB3F97AEB903F146547AA76D34FB18C8965EC0D119F7911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320682, "uuid": "b458df7c-9053-462c-aa29-da1ddabe666e", "value": "1059dec3a72d4c311e39c8fc33d5af98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320682, "uuid": "e271ac71-5099-48ab-a295-7316d3021177", "value": "6144:PQXvqLl4JINqB9QqbJq9AbuR/RzZ+fRpc96lnVPk5XtlOkiETHyROnR:oXvQDQVq9Ac5ZuRI6lRkzloEzyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644320682, "uuid": "0aca0f28-1646-4c66-8672-08738c2573f1", "value": 596992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644320682, "uuid": "889bf654-f1fc-412e-9a24-b544b0cc53ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320682, "uuid": "b61dea43-ee52-4b47-bc40-9e9feed246e4", "value": "emotet_exe_e4_200cbd5ea69a321cc367b8a9b6fdb77829f260c32a22b6f71038e0fd4f1f03d1_2022-02-08__114433.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0ef1d9-88fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644338254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338254, "uuid": "0a5a6dd3-7d3f-430e-8eaf-8114c87961bb", "comment": "Malware payload (Heodo)", "value": "63f2be70f9a7aee6af51cc45370730fc", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338254, "uuid": "ab2fcc4e-8056-4d75-aad5-13dff2d754d4", "comment": "Malware payload (Heodo)", "value": "2028a7a3dc6eefaf2e4a90da3773993b9aba2be84736a78457195bc7b8cbce39", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338254, "uuid": "05644a63-f844-4105-9b8a-974acba3e184", "comment": "Malware payload (Heodo)", "value": "1f0120beacc8cd11c339c6e994a6e826c2d3f289", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338254, "uuid": "2d804a5a-cfaf-49fc-9fce-ccbf00c11819", "comment": "Malware payload (Heodo)", "value": "d842478148d6155245b9fce7f8174d3de2ba306936eeae3d1788dca0bae3369354ffd6f852494c8889b23d8650471065", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338254, "uuid": "e1d59cdf-f092-44c8-a3df-7e05687c53e6", "value": "T196C35A55F685EA1ADE0822350DDFC7F9333ABC828E9683473299B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338254, "uuid": "ec43f74d-ccd7-4824-a387-9e467142e913", "value": "3072:HVcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBH:1cKoSsxzNDZLDZjlbR868O8KlVH37ker", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644338254, "uuid": "b56cb443-7b74-4783-b2d0-3d053659ddc5", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644338254, "uuid": "51c6c7ff-0c53-4d34-9b09-75791dd111f5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338254, "uuid": "8af14998-91ef-4fba-9799-b49cd3f3e070", "value": "tmp14sbqdut", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "625d8aea-88be-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644311181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311181, "uuid": "91e51b21-1345-456b-b171-8c618cce2bcc", "comment": "Malware payload (Heodo)", "value": "325ef8b0ebe6841f1526b4adee803fb6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311181, "uuid": "029968ec-9449-41e9-9bf7-01fd3a88d925", "comment": "Malware payload (Heodo)", "value": "20c88b545150b518cd25d71a0732bf3eaa9fb2c0365571aa6ff8c192951c95bf", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311181, "uuid": "c23dfa2d-8a86-45ef-aea0-8e46a1a95c7a", "comment": "Malware payload (Heodo)", "value": "0dee1168bd4bb078a71e896881c499674f1b763c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311181, "uuid": "7bfbdc29-9ca8-4a4a-afa7-70dbe1fdb3de", "comment": "Malware payload (Heodo)", "value": "b3d44167ee081f42b22447de00812835ea87fc4eaaa03bc2847743ed17e83d1f41f99d6ad3646cc534d023dda41f8813", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311181, "uuid": "d649cc85-d7a5-4e86-9465-b522cac8c17b", "value": "T1B9C36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311181, "uuid": "f6e09568-6602-43ef-add0-e1e1f465ea2d", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644311181, "uuid": "9b79ced7-0f9c-4cbe-a5d0-ae05c6489fef", "value": 128277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644311181, "uuid": "ca3104c1-985d-4536-b7bd-6d775f91d218", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311181, "uuid": "926241fc-165f-424f-b251-904fa30354a7", "value": "tmp_lzawqaq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b536136e-88ab-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644303160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303160, "uuid": "7d9047dd-ee5c-41f3-87f9-15d56608d191", "comment": "Malware payload (Heodo)", "value": "3e8f80e852f688cf5e6f38de22f4802f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303160, "uuid": "42d9eb80-fc74-4ea6-ac2d-5162c9237cb8", "comment": "Malware payload (Heodo)", "value": "2108623ec48d364603e813e36793e956263bd1141b5aff193fc3fdc6b19eaf59", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303160, "uuid": "cc10e429-25b6-4992-b8c5-864dfc784bbd", "comment": "Malware payload (Heodo)", "value": "34e875fe1093f03814b5e7c7c9e11c6b79759937", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303160, "uuid": "a0a0e939-4a39-4d04-92ca-71d33dfdf79f", "comment": "Malware payload (Heodo)", "value": "2644826b5b2971f40ef67affc9034e08db498d3f4a3d0abead5f0deb31a7c5f0a51ab10d3463d76a6605760af919a7b6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303160, "uuid": "d1790490-50f5-4ae2-8198-2a100994c4d7", "value": "T10393499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303160, "uuid": "0f1cc467-3a6f-4531-a84a-7860977406c2", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644303160, "uuid": "ac0aa84a-f72f-46cd-8f48-d951fc0e5d54", "value": 96793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644303160, "uuid": "a0209d16-a797-4754-a6b4-9eae6c28661e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303160, "uuid": "d14ff22c-e889-4148-8146-18c80ab114ed", "value": "tmpv8s4z13n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33c3c81-887d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644283507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283507, "uuid": "2af1c37c-324c-4f67-88e5-c9c1fa1e1ab4", "comment": "Malware payload (AgentTesla)", "value": "dc4b26fbe00e5a509850672c8929e385", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283507, "uuid": "bf6c6ff5-5e6d-4cc0-ae42-c30e845ebcf5", "comment": "Malware payload (AgentTesla)", "value": "2115ce3c7e13d0bcba9871a86580650a5047a0f92a4c421e93dd521f6023a67d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283507, "uuid": "541054aa-f361-46f2-a4a3-1a43a3573a76", "comment": "Malware payload (AgentTesla)", "value": "5773a4da8bcbb5a35e8221f4d6480ef2e42c09e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283507, "uuid": "51455993-8761-4479-9c20-a622f0bcd478", "comment": "Malware payload (AgentTesla)", "value": "5f95eb5fc61b1fbc575da26f252d9e408a70bf0567bbf6965b987a5552698e88b5024b761622570d2fc1809a3f48ab9c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644283507, "uuid": "c4da13f2-fd99-4bab-b832-f08af9a5b8d4", "value": "T1D3D44AFD712079EFC89BDA328F681D78AF50617BA30B6217901716AD8A4C997CF150B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644283507, "uuid": "aa6141f6-7857-4997-afb3-ca52892180f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644283507, "uuid": "8bca19b8-942e-451a-a7a1-44ac98a35295", "value": "12288:sEkPm9Ac9o61tGXEAxwfF491aAMWeoAeYUE/gJ51UYRK50pjmjApY:mPQAkorU7jAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644283507, "uuid": "6c80c270-82b7-45c1-aaf5-3c081957e6ee", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644283507, "uuid": "302e9317-165b-4c0e-baa7-36fef90a39da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644283507, "uuid": "091585f0-a5a2-4bf1-aaeb-cc290e6cdef8", "value": "Halkbank_Ekstre_20220207_073610_754008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade36ebb-889a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644295846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295846, "uuid": "6ad81060-9034-4e96-bbdd-1caa59c68b55", "comment": "Malware payload (Heodo)", "value": "8134c1f1bd1185064b4a5c4f4875ffa5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295846, "uuid": "da12c5e7-a9cf-497d-8e35-44cd16be8b48", "comment": "Malware payload (Heodo)", "value": "2124b8e6f34b20d9e88ad161d9e024a02154a8d34c824995e19e2bd4ea3cff4d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295846, "uuid": "d2dfde86-bf89-49cf-91d1-7a1f3a6ea2b5", "comment": "Malware payload (Heodo)", "value": "5aa444a46492cf64833cf361785a817497fe6108", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295846, "uuid": "44ce3691-4d82-4e6c-ad6a-5e6293b3378d", "comment": "Malware payload (Heodo)", "value": "9dcf04e0a84f004d70792321305e02b4835ffbb220e46174e141c06ae2c79b06763b358282259fee3dac42e88decbd2d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644295846, "uuid": "e3de01c5-1df6-4828-b146-0de9112a344b", "value": "T16793E16D7E2C6D0BD5CBF238DF38D96093145DA069A2F8BA50A06F6D103D4D3C16AE6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644295846, "uuid": "c231c1a0-8f6b-46c5-846f-986b2e3ff1f2", "value": "1536:zZRkPTNcOTsMVctMdRSKa3Xm1WBXz7yL64i+kkfa+3gtfvjHtoxzg5bjIFgB:zvk7COYMKmLa3Xm4nC5X5gxvhoxzMIKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644295846, "uuid": "24cd781e-03b5-458b-9910-95b700ee08bd", "value": 94221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644295846, "uuid": "0a00a805-62a5-431a-ad95-03d1620c1c89", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644295846, "uuid": "4b109953-f63a-49b9-906d-7b639028991a", "value": "tmpnaa61ild", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ede261-88c5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644314242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644314242, "uuid": "5cf836b5-4623-42a0-a998-557f9bd33046", "comment": "Malware payload (Heodo)", "value": "697ebbaebc8b29fb240f4a371b262cf9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644314242, "uuid": "72bd5862-c476-4e67-8a42-2bbba77ba342", "comment": "Malware payload (Heodo)", "value": "213107105539f237753fd3d6a79c144077141238d22e2c46869572b58e18682a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644314242, "uuid": "9f71476f-497e-4c58-97ba-7bb948d7bcd0", "comment": "Malware payload (Heodo)", "value": "1928efb8608eb48932b2fd44db4a5e677d55c444", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644314242, "uuid": "8302c80d-fc69-4dd1-9dc6-fd38fa3c9ff4", "comment": "Malware payload (Heodo)", "value": "a497898d2974653433c749f33c0c6e6429b3d19f25960accc3cdff47062b09619ce8abf42691907a9fa46ba0624370bf", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644314242, "uuid": "5d98fa0d-1766-4db6-abee-ee0162c98030", "value": "T1EFC36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644314242, "uuid": "2231c9df-1b9e-4434-a769-1eb5a2eb2c74", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644314242, "uuid": "e1d05982-d365-413e-9258-000cca32631e", "value": 128551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644314242, "uuid": "547bb38d-f4d4-48f8-a2e3-0a10923225dc", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644314242, "uuid": "55ce2b02-6c9c-4245-b676-7fb69b66a05c", "value": "tmpyj5ns3yr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0863aa7-8932-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644361188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644361188, "uuid": "ba05d471-3901-4e13-b7ba-9749c69d173a", "comment": "Malware payload", "value": "9b5930f9feb04ef33329d07dfb287240", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644361188, "uuid": "4b900efe-2d89-4973-ab02-b99daf7bbba4", "comment": "Malware payload", "value": "2132dadea33d1c052e117f67cf7fd213638a4ddd0d7e67817c341c0fc7fb9697", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644361188, "uuid": "5390cc3b-e45b-4b18-a358-11149754c593", "comment": "Malware payload", "value": "16b1c2f3d12deed50d340c5c9ba4cdedebcb6bcd", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644361188, "uuid": "930b5526-6c14-4a16-a743-cacf852c4219", "comment": "Malware payload", "value": "bb7255aa05970b09c2c7d3453f62497d96706ceb2e7c460b24ef921f73a90f7d9c5aeef8546fb3b57211c64d33fadef6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644361188, "uuid": "b066a5c8-fe65-4466-b2bc-f2d722b44634", "value": "T12AC35A55F685EA1ADE0822350DDFC7F97336BC828E9A83473299B32F3D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644361188, "uuid": "7267bcdf-38d5-432a-a39d-bb46cd322dfe", "value": "3072:wIcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgiBy:zcKoSsxzNDZLDZjlbR868O8KlVH37keb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644361188, "uuid": "e3efad99-402d-4c89-b93f-fb55bf68caff", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644361188, "uuid": "19348da0-fbcd-47bb-b339-7997b461bd17", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644361188, "uuid": "13528831-e689-4f25-9b5f-34149ac164bb", "value": "tmp29alevur", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc32f5d9-88bb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644310097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310097, "uuid": "0dca5a21-c63e-498f-a938-3a2b3f0ee42f", "comment": "Malware payload (Heodo)", "value": "fe7d4552f5d08a4aa84c9236882cd228", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310097, "uuid": "225dd389-2f3b-4bb7-9344-dc8fb475705f", "comment": "Malware payload (Heodo)", "value": "21a2f887be678ee89e16569e9b57a53daacd32f2b844776161995ba908b45407", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310097, "uuid": "dfaf19b7-d02a-4390-856c-1d32064969cb", "comment": "Malware payload (Heodo)", "value": "7a6b49f2db81e5e7d6f4afa62c6d5b3d84319bed", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310097, "uuid": "93b71a10-e930-4c9a-97b3-b1ac912793c9", "comment": "Malware payload (Heodo)", "value": "a3d7bbbb5fc621a43b223aafd48ca8a724615550ff92284ef9ce3a6707d05c3122538964501c568039e1ed03721b1a6b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310097, "uuid": "bdecdcfd-7702-4af6-b1eb-4491f56ea6c2", "value": "T14AC36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310097, "uuid": "7031badd-97d6-4549-ac90-be6de967461a", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644310097, "uuid": "4f3ad876-6d01-4647-9e99-f014e09015e6", "value": 128111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644310097, "uuid": "19b3bc49-eea1-447c-b0f8-d7ffe47a814f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310097, "uuid": "0d511a8f-4fd4-4cca-a331-e5cd4884c0b9", "value": "tmpieflcpf8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46eb5ac1-88af-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644304693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644304693, "uuid": "ea0b2013-5aa7-47b1-a6c5-43abd13444f6", "comment": "Malware payload (Heodo)", "value": "eecb00f13e6e891657efdfb022bd52bc", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644304693, "uuid": "1e52daac-24fd-4c15-a2bf-08e82195dfce", "comment": "Malware payload (Heodo)", "value": "21af94a9305ada1cb86530eda6198f0cd26b32fe8ae863a49d2188dbe9d95cec", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644304693, "uuid": "71401b5f-031f-441f-94df-0fde27a4ba2a", "comment": "Malware payload (Heodo)", "value": "edec1fab4761e1bab52beedfac8ce26ecdeb39c6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644304693, "uuid": "2b03bde3-2929-4bf8-8986-5be98618d7d2", "comment": "Malware payload (Heodo)", "value": "46f4ca6e2cb655c852cc6e9d89089f437b5eb2f419b49fb4226e05cb7af766568e01f78141c441dd5f147687c7be3ff5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644304693, "uuid": "e8946594-7744-4ded-94f8-22f2ed9c2619", "value": "T12F93499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644304693, "uuid": "6bcca178-37bd-46fd-911c-f29847178e2d", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644304693, "uuid": "167f2901-dc8c-4a43-b9a3-2e5f85975ddf", "value": 97261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644304693, "uuid": "58fc8046-d3a5-4979-a22d-6858616911d2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644304693, "uuid": "a9b9c5c5-594f-47a1-ad6b-78ba662ca223", "value": "tmpui2rhih9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d47a0e62-891a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644350886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350886, "uuid": "5eca9288-d080-4d84-8ebe-3da4bbd53e15", "comment": "Malware payload (Heodo)", "value": "d59f5a638fa78a09aa7dea9d6422d7a8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350886, "uuid": "c57d9c08-1ee9-4db3-acff-afb0f04e189e", "comment": "Malware payload (Heodo)", "value": "21c5a5a10e5f53c80ec1826e0687eb3dc5328bf4c5622dd8a43e03e15c1c2887", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350886, "uuid": "abd012b4-ce32-4fe6-a091-2cbf25e89b26", "comment": "Malware payload (Heodo)", "value": "b4cdaf4f03dd2f64ec16101177f2777f6aeb3aee", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350886, "uuid": "5b00150f-3fee-499b-9bfb-9dd8359f4bfa", "comment": "Malware payload (Heodo)", "value": "679f4d2cafa62ce8dd6f1ca5422133258f96bdb9c83754fccd15659da3b467492a22e50f4c2d65d304736512b853a570", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644350886, "uuid": "a04c4f37-c57b-4b00-9fa6-4d7b1893f2cc", "value": "T12FC35A55F685EA1ADE0812350DDFCBF97336BC828E9683473289B31F7D7A550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644350886, "uuid": "9df79a11-dd9f-414e-845d-cd6edbdd8050", "value": "3072:+dcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBe:0cKoSsxzNDZLDZjlbR868O8KlVH37keW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644350886, "uuid": "f1d97200-272a-4b0a-bbc9-b9016ccd5cd6", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644350886, "uuid": "90d2afce-979f-451a-bd70-f77556ad7e21", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644350886, "uuid": "c67ceddf-a0cc-4c3e-9cff-7a010d832edb", "value": "tmp7i1p88iw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ad8b60-889b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644296148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296148, "uuid": "0aebdab7-2404-4181-b369-f9a515cc2bfb", "comment": "Malware payload (Heodo)", "value": "e429a5b22d363cabf5889d67d1bc98fc", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296148, "uuid": "c45155c8-167c-42fd-b3a9-8bdf3a51446d", "comment": "Malware payload (Heodo)", "value": "21c78aac5a87017728bd6e29d945ec8f273b12ffed6a3c1b06bfa0cff9530551", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296148, "uuid": "a6e13c74-95b5-4d9a-842b-15b2b0a1439f", "comment": "Malware payload (Heodo)", "value": "622c22f437ce20c4b92068e6448e5fa75866cd41", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296148, "uuid": "b0f46fea-e819-4599-a40b-d74444e56129", "comment": "Malware payload (Heodo)", "value": "1849157b07123d0947bdccf15139264e300a0f4ae8d3c283da5723de4d1c2c5f5797e112a17b72282268decdbdd7eb6d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644296148, "uuid": "398f9b0d-8d78-410f-9879-fd693840a4fe", "value": "T1AA93E16E2E1C2E0BE19BE139CF38DD6053656CE1A292F4BA70702F69503D493C665E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644296148, "uuid": "965ed277-f221-4c4d-be5b-ec8d7f422085", "value": "1536:zZRkPTRTMjzBpPnSKa3Xm1WBXz7yL64i+kkfa+3gtfvjHtoxzg5bjIFSyPmP:zvk7RTgpBa3Xm4nC5X5gxvhoxzMI3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644296148, "uuid": "f97a4704-91c1-432a-a589-50a9d01a0bb2", "value": 94229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644296148, "uuid": "2fee86fa-23ed-4c8c-bca3-4a0d3d85e319", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644296148, "uuid": "c4231254-73bb-4d93-86d4-4310dd451007", "value": "tmpo8e60ki8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c109899e-88a0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644298455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298455, "uuid": "377f300c-0627-4ec7-bcb2-d9b8528f3f62", "comment": "Malware payload (Heodo)", "value": "8c3a624158bfcd0f2cb21861ce540ae1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298455, "uuid": "18a109e5-3cd4-4318-9eaa-db1216a6543c", "comment": "Malware payload (Heodo)", "value": "21f0ece1dbc88d77cf07aaa4093d250148d7f920586db75f5efbdf70a6ab56b9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298455, "uuid": "3b6211a7-8059-4c20-aeae-a8c98f4c3dde", "comment": "Malware payload (Heodo)", "value": "46b1a2423f521af08ce7e455342f3905f1ac90a6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298455, "uuid": "7ebcc305-ec69-4aa1-8e4b-82f39f8cdcdf", "comment": "Malware payload (Heodo)", "value": "a61882f75108844f33b79fa300ad3888dfdd071c41b0ea4b00c47995e10800e3bde8489b0f187c517dfd3d83374ef8a2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644298455, "uuid": "0b33c416-734d-42dd-b004-b9b29ee524d8", "value": "T125D39D6ABA48CA0BD94913314EE7CBF67336BC819F5297473295B72F1C3A580CA07B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644298455, "uuid": "b3cb958c-e7cb-471e-9549-191a368856d1", "value": "3072:vcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3l:vcKoSsxzNDZLDZjlbR868O8KlVH3skeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644298455, "uuid": "6db52d3e-1760-4794-af4f-50618b463e50", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644298455, "uuid": "f04305fe-daed-4e95-9ffc-3ce645a02b49", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644298455, "uuid": "5013f07c-ff43-4bed-b962-9f686e2fd5d5", "value": "tmpgza0oj0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37275ff9-892d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644358783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358783, "uuid": "8d9d7187-9461-4b49-b92c-49f278523d18", "comment": "Malware payload", "value": "f254565cbbf9ce191f59e74bd509a0cd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358783, "uuid": "0c191f2c-310a-4bc2-926c-18d21431240e", "comment": "Malware payload", "value": "22561295b0098545bb413f01677bfa218911e72c57591d8462840c0b941b80c1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358783, "uuid": "41795f91-978a-40ca-a14a-96e3b3a26f40", "comment": "Malware payload", "value": "90467f84f181677785ab807d7ba1915182b4585c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358783, "uuid": "a71c8db5-7738-4217-a5a0-7dbb80617cd8", "comment": "Malware payload", "value": "28798e90596696bb66673b86eba64111d0b6c15cee624ebd4ce99b9a09439b95fa4f79e5cf0abb644f370aa3530ad0bc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358783, "uuid": "86422d44-76c4-4c62-98af-3e6086bc25cc", "value": "T133C44B13E68398F1C79C803973AD7BFF802A155547E876D30BF1858869AC0E14BB7D9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358783, "uuid": "9a9a971d-8247-4da1-b7d9-e73156516bb8", "value": "1059dec3a72d4c311e39c8fc33d5af98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358783, "uuid": "96a56107-fa55-4536-bb9b-008c457db9be", "value": "6144:/mbbvqXJery1jH9OttfeRdq9r8BVBALMaXvc9e8h2qYJVwdFmFlE/S:QbvqX4+eKdq18mLRXieg2jJ0F9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644358783, "uuid": "8b7724f5-094f-4161-a1f4-b35ecfc5e8ac", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644358783, "uuid": "023d2e0d-2f00-4208-818d-93fe21a1ad45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358783, "uuid": "7a956cd7-163c-4f75-a4dc-3f53d0a896c2", "value": "emotet_exe_e5_22561295b0098545bb413f01677bfa218911e72c57591d8462840c0b941b80c1_2022-02-08__221932.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2def37f2-893a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644364351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644364351, "uuid": "6d430e4b-2bcb-45a7-93da-d456570ccb31", "comment": "Malware payload", "value": "42e70b39449e6ef95ddb8bae996befc4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644364351, "uuid": "5acfa8f1-564d-4533-82ae-79632bd90665", "comment": "Malware payload", "value": "22822e66102376ea09257aaa161ec7ff12dd1469536024b7aba8b659d8b0ac6a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644364351, "uuid": "74c50128-20a3-48d8-aae5-7a36f90437ed", "comment": "Malware payload", "value": "cf3e1dc0295c0ee67f4add56b2b6240d6089db19", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644364351, "uuid": "ddd97a5e-05f2-4b23-bef5-05851ee71ffe", "comment": "Malware payload", "value": "e25f6509d27745ce3200326c0a11fb8b7a049cfc57cd7557905def7d8e8fe79214549cc65387abcaa7e6dddd3782ff2b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644364351, "uuid": "cb06856a-c567-409b-95b0-c2aa467cc30d", "value": "T1F6C35A55F685EA1ADE0822350DDFC7F9333ABC828E9683473299B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644364351, "uuid": "e978fed0-06c1-4b75-8e77-10207744f81d", "value": "3072:CPcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBx:acKoSsxzNDZLDZjlbR868O8KlVH37kep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644364351, "uuid": "70863a0c-14d6-4bf9-822d-8ed7b727b52b", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644364351, "uuid": "5d4ace8a-2a39-4c14-afd7-97bfce11242e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644364351, "uuid": "cdb09cd2-3377-4cd2-a98d-3bc168cf148a", "value": "tmphtfej18f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eedbe22d-8919-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644350501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350501, "uuid": "92bed446-ae24-468e-8ba3-9beae8fec193", "comment": "Malware payload (Heodo)", "value": "dc93f7fea1c43998165fad688ee5aca0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350501, "uuid": "c4b403f0-5ff4-41d6-9fe9-04237ffa34dc", "comment": "Malware payload (Heodo)", "value": "2289c3090494503037607e82a89748d06dae3bc85be888f2415bfc2ef33ed418", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350501, "uuid": "5301c2ec-c459-453e-a859-c2a3b4cd7547", "comment": "Malware payload (Heodo)", "value": "56731fa983be0242da2e7986b947258c0b4faeed", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350501, "uuid": "a9726d90-6a7e-4a86-b9f2-2ee06f3e51bb", "comment": "Malware payload (Heodo)", "value": "847b39689a2953937d577712b84ac983fdd337a37c73bb3048a52e188ebb98249b05a9a1903bb39cc0e323d5aee975c7", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644350501, "uuid": "a57d931a-e935-4680-b628-681e4518ef73", "value": "T1EDC35A55F685EA1ADE0823350DDFC7F9733ABC828E9683473299B32F7C76550CA12606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644350501, "uuid": "c733548d-4698-423c-8594-a990309ccd1e", "value": "3072:4YcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBQ:vcKoSsxzNDZLDZjlbR868O8KlVH37keo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644350501, "uuid": "ab970a87-032c-4bf3-b135-3c2bb2b7ddf3", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644350501, "uuid": "87332bf4-0e15-493e-8d0f-4b5a187f75d7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644350501, "uuid": "09122e9f-fd89-4b9d-84b0-3ef0fc45af28", "value": "tmplig2b95c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a55b232-8922-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644354225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354225, "uuid": "985f1ce9-6a07-47d5-b2e4-e852579e28f1", "comment": "Malware payload (Heodo)", "value": "6f0733463d48b83868398a58c8533a77", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354225, "uuid": "6db8f826-07a7-4e79-8177-ec826754036f", "comment": "Malware payload (Heodo)", "value": "230f6a75d0cbe704831a8a45b9b037bb5f5b829ddf92a2a005bddd8eea55013a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354225, "uuid": "1eabea29-3258-4da8-9b3c-264e229c37c4", "comment": "Malware payload (Heodo)", "value": "afe35a5b82184803bf15928f80e921c5ff19f95f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354225, "uuid": "2e593903-3748-4aa3-aa86-d0168a6ab6f0", "comment": "Malware payload (Heodo)", "value": "4884acc8b256ce7491a700e7f98f9274ada4800d60a79385b930e26f6cf4042847110292c402d87023e81e0242639fda", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644354225, "uuid": "49ef8143-8787-4fba-ba8e-bb062ec47c3e", "value": "T1CAC35A55F685EA1ADE0823350DDFC7F9733ABC828E9683473289B32F7D765508A12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644354225, "uuid": "49f15e76-dc14-4484-b11d-08a8520e9d13", "value": "3072:xzcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBF:BcKoSsxzNDZLDZjlbR868O8KlVH37ket", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644354225, "uuid": "35b8f94c-4ea4-49cb-823d-44fa0d20e99a", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644354225, "uuid": "0239fe47-1b68-454d-85b2-8f111eec3d5b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644354225, "uuid": "b5a9a6a7-112d-4a38-b99c-945f8f1cf562", "value": "tmp_6cci6o7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "988b280f-8929-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644357228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644357228, "uuid": "58153825-422a-44b2-bebc-9e6608778bb2", "comment": "Malware payload", "value": "b7ea348e46f737306ba90c7f985ea3b1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644357228, "uuid": "4abd0f8c-adb3-4e38-8040-d85f57805eb4", "comment": "Malware payload", "value": "2318d27e8d197a684fd2b5d1c36946e117b5332260c3c13323a7bff01a00be67", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644357228, "uuid": "bcabb79d-1fba-4208-82f2-ad27c4a92e52", "comment": "Malware payload", "value": "4431995404c129941409f3627253e32d357f14d6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644357228, "uuid": "e222aa2c-4ff3-4924-9fcb-8645e9193905", "comment": "Malware payload", "value": "54a3bfaa8bc919d87c449c5163c7f7aa5650d3c635783c831d56333deebd21a66f92682385a3de2002fabcd52e254f2b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644357228, "uuid": "c19069a2-77c3-4e23-a854-51166992f909", "value": "T144C35A55F685EA1ADE0823350DDFC7F9333ABC828E9683473299B32F7D76550CA12606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644357228, "uuid": "5bc633ea-b6b9-459d-b3f9-480abc7713b3", "value": "3072:YBcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLB9:+cKoSsxzNDZLDZjlbR868O8KlVH37keR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644357228, "uuid": "36d34516-3ed6-48c6-a08e-271d3e40b69c", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644357228, "uuid": "f2a6d713-8d1e-44a9-ad06-f6294d1ef416", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644357228, "uuid": "a7a960a4-7a51-4050-8e7d-72bd3f6653fb", "value": "tmpgtggk0wo", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8beddd6e-88b7-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644308244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308244, "uuid": "ab31313a-9464-4b06-8207-c6d8d7b15443", "comment": "Malware payload (Formbook)", "value": "a497c027535b445ca14022705484af5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308244, "uuid": "bb057913-0814-4ace-81b6-a907dbb2d3e1", "comment": "Malware payload (Formbook)", "value": "231a3fbd49c3daf40fef287f590ab7aa161ca51b09ecca28f5cdd92d4c9004ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308244, "uuid": "08e4eeb7-8423-453e-85e6-1ceb5081fd46", "comment": "Malware payload (Formbook)", "value": "c435d13f3a5fe39b96c37a47b04a001a08d6b5fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308244, "uuid": "4755da8d-cbca-4f7b-8cbf-9796f1720fbf", "comment": "Malware payload (Formbook)", "value": "d6e842c151d7d266576130945095a75d302be489667ade030588956a29e3fa9e1de456cad0f4bb323d7166669b89b059", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308244, "uuid": "29bca3e8-7370-400b-adff-7733e5ab7b9a", "value": "T1DB3412BD50C4E4ABF6C69F32187BCB17E7F7A3121E25891B9FA44D5A3506087E421387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308244, "uuid": "c8586809-5ffc-4cb7-b9b9-13a2aecf6c82", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308244, "uuid": "6ce0b96a-7a51-43d2-a813-662e6765dcb3", "value": "6144:ows6QPZhBefw3chPgQotzwIP4XEHzozBcNufG5scjY1Tn:3mhBdgOsKCET6EAGpYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644308244, "uuid": "a5ad167a-7638-4df1-b546-7141d89b00a9", "value": 247896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644308244, "uuid": "064ad7db-4d77-4da5-ae61-61abc0fda29a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308244, "uuid": "43594c5e-1704-433f-b146-277d8a3b913a", "value": "a497c027535b445ca14022705484af5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f380403-8934-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644361803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644361803, "uuid": "85afb341-0f83-4ab0-a3d7-43e8938f2eed", "comment": "Malware payload", "value": "384ad2c18658ac72ee1bc5e9c737f767", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644361803, "uuid": "1d633f7d-a03c-4d6e-bbd1-6199aa19e0da", "comment": "Malware payload", "value": "233b37fb29531e2ccec9604368b361644674e0d61f323e0deacadab436b56257", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644361803, "uuid": "9ca0c4e5-57c0-4b49-8dd2-4aa3876f4817", "comment": "Malware payload", "value": "d5c3efa9125c15f0ec8b2f3977f2bc2917b0ba7f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644361803, "uuid": "cacd6280-25d3-4a2b-aa7b-f012ef7edf19", "comment": "Malware payload", "value": "4fab503a44cae61f79206f9e7875b32a937dfd9ef29fcd433f63864674844989bf9ca386b3978bbbbf2f57dfed80a057", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644361803, "uuid": "0382e395-ae1d-4a5f-8f34-10c629621b97", "value": "T1FDC35A55F685EA1ADE0822350DDFC7F9333ABC828E9683473299B32F7D76550CA12606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644361803, "uuid": "45e925eb-7b90-4eb2-8cbe-53c38770ecfd", "value": "3072:YEcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfB1:fcKoSsxzNDZLDZjlbR868O8KlVH37ked", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644361803, "uuid": "f59950eb-1b71-471d-9d2b-c7741621fb9f", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644361803, "uuid": "9550c6b1-e843-4cd3-b715-3d5199120128", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644361803, "uuid": "afbd9be8-ee01-4ce4-b9ee-39e3fe545880", "value": "tmprif3vhrs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d13a49f0-8903-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644341002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341002, "uuid": "89518850-7e63-4790-9786-cccf0ac6e7d8", "comment": "Malware payload (Heodo)", "value": "7bb15fe4a0c2a7ac302efae3803d6d22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341002, "uuid": "ce2fe75a-f337-4668-a3a2-85c2ba99e30e", "comment": "Malware payload (Heodo)", "value": "23435f07664fb82f33e6aecda036802127a0b5a84d6e3eef716fa309f0737c09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341002, "uuid": "8003577b-aa33-48d5-9aa7-11c64dae346b", "comment": "Malware payload (Heodo)", "value": "f4b29443822ddb88987c3a9f90206dd63bcc7e66", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341002, "uuid": "996e07ff-b5b8-4a48-bba4-5354de73b0cb", "comment": "Malware payload (Heodo)", "value": "dd971535f6167145d72af901e6dba85132ad6bbdd71efb3d5ef6a2b40236ea0d863d56bf7976882a1c34790172680f28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341002, "uuid": "6f855e75-e0c0-40a2-944b-10865e1b4c7b", "value": "T108F4C0006582907AE4F930B842667BF1E93D1CB0372511D39BD069FEA6E41F1B6B376B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341002, "uuid": "0f400c43-5a7f-4761-b0e3-6223d7fe95af", "value": "36d18f8cb3bee16af0421e6a936157a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341002, "uuid": "1a05c706-c35b-4439-82be-f0bbe42fd39a", "value": "12288:lBseOTwOg957PAMTEFv49thrFcmxLFwD7wGcXbtzbEOpUDlByawsoei4:keOTwOUPnTC49LJxJwaCOpUD7Noei4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644341002, "uuid": "8782830e-52f0-46b0-b802-3e0a09500767", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644341002, "uuid": "e73fc95c-8270-4ea9-b168-377ea046472d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341002, "uuid": "ad7ddb2f-94fe-45d1-8ed2-2186238e4518", "value": "7bb15fe4a0c2a7ac302efae3803d6d22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45df529-88cd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644317869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317869, "uuid": "967ef457-d453-43aa-bde5-20c541993ee2", "comment": "Malware payload (Heodo)", "value": "402e1f1d00986d6ca973fd69a7a78a89", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317869, "uuid": "c787e770-e4d7-4e72-91c9-18d858634d22", "comment": "Malware payload (Heodo)", "value": "2361d04fdea5acb7269a91fc0395185181f4b911611152594093eff14b3379e0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317869, "uuid": "0257581d-84eb-4d90-afda-6c904fcbdd44", "comment": "Malware payload (Heodo)", "value": "5ab0da62ebc1ee4fc9905c4beacd8b16f9900cf9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317869, "uuid": "b75d030f-599d-40c5-adfc-163a38e90dd1", "comment": "Malware payload (Heodo)", "value": "cd76a71218925543379ade0108468f847fb26577b9929b42320dd9e5bc4b98c553f276d3e5dda48dc8185ddc09c44c96", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317869, "uuid": "18c7bfab-e96f-46f0-965a-ab4b30da2582", "value": "T18C93499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317869, "uuid": "eb96172f-b62d-488c-9b86-c1493fd827b0", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644317869, "uuid": "d1dc4ad8-35b4-44eb-af02-1c584b19a4c0", "value": 97333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644317869, "uuid": "23bc7795-12c3-4c7b-b401-9289dbe46fa8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317869, "uuid": "6c847dad-0a93-4cda-b6a6-04da3da56f1e", "value": "tmpfj0jt416", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b9de1b-8878-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644281308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281308, "uuid": "19f46e4d-6c70-4f0c-b999-b8750de6f329", "comment": "Malware payload (Mirai)", "value": "ad1afd513b2508c73894c149eb0a6636", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281308, "uuid": "f7223549-8da3-498b-9d57-7c099065006f", "comment": "Malware payload (Mirai)", "value": "23baaffc1ca3f34443d164610ffb063c4596d03a448e3eac8bb23dec70e4e1f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281308, "uuid": "93805987-56fa-4141-bbf1-6726498e2645", "comment": "Malware payload (Mirai)", "value": "23d57428620aab2b2a1a5b9216f32353bc96582f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281308, "uuid": "973a443c-be17-49eb-a22f-6a53d5232c67", "comment": "Malware payload (Mirai)", "value": "07197dcdd650d40e7914dbdc226ca4789f434ab69d9713ec43d0134b379717f80cdc0d984b3b91ba3ae90be73245a4fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644281308, "uuid": "66e53832-1a8f-466f-887b-118894661a91", "value": "T13783C71E7E219FBCFB9D823447B78E11665933DA22E1D284E1ACD9105E7024E341FF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644281308, "uuid": "fe09f7ad-d025-449a-8e13-e4cac5923758", "value": "1536:FihvmlY2oyrjnsbjmoOu9zMAI4iGPDYgvD/rABU6bUB9N6ca10etvV:YvmlY2HsPmoO8I4FPDhvD/r2U6wzNQpV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644281308, "uuid": "874eb298-e773-4c26-b51c-9143406229be", "value": 81540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644281308, "uuid": "aec9a2f5-3661-43a4-938b-0a64c188b412", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644281308, "uuid": "7524c62a-abda-4b2e-9988-823556b6a6c2", "value": "ad1afd513b2508c73894c149eb0a6636", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b42a2b-88ad-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644303726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303726, "uuid": "db50fbd8-18b8-4ff7-926e-add7e1aff80a", "comment": "Malware payload (Heodo)", "value": "eb41ec1ae6eaebb32ac8066ffa71b356", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303726, "uuid": "a46ee005-06b8-4fde-8c48-f9bac19008f1", "comment": "Malware payload (Heodo)", "value": "23f1b5449f3bff1435cebe7a48596bb1ea70a721a84a3ed2f8587bd794c67efe", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303726, "uuid": "5de80565-5bfc-4085-8476-69c907b8104f", "comment": "Malware payload (Heodo)", "value": "a92ce380a43ae78f8cb9defd7022bdaa984eb837", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303726, "uuid": "6d9ece8a-bdc0-4e1f-8612-d240bd3e6578", "comment": "Malware payload (Heodo)", "value": "7bcfb27fe672fc434419bc576182462bbeb3558b8f6147fe322b142a34c9cc600650d0b3da7f42c3121840c926ea92bb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303726, "uuid": "81e5934a-ed2d-4b6a-8a39-5f8a0f97daff", "value": "T16093499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303726, "uuid": "012f4c3f-e92c-48fc-a8f6-1fa4356a9cf6", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644303726, "uuid": "5e54ae30-968d-4c2b-9409-8e9516dacb71", "value": 96673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644303726, "uuid": "97a338f8-3a06-4bdc-81ff-72db41dad450", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303726, "uuid": "2d826f5f-ac28-4d15-9b49-61f15c9b7965", "value": "tmphng6ttbw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3093c75d-888f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644290911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644290911, "uuid": "f39e091b-c9f6-46df-8dad-4f1e1f902cd0", "comment": "Malware payload (Heodo)", "value": "0fb8831272bcfb99440b207bc3e3f031", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644290911, "uuid": "918fc444-7889-4ea0-8d61-13410be3c20f", "comment": "Malware payload (Heodo)", "value": "2416bebdb6655e9810cff3f6901fd9320c421d1c37f4e83f25079bbbddd60291", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644290911, "uuid": "71263ce1-85df-4df1-9c51-5d2d7320bf88", "comment": "Malware payload (Heodo)", "value": "252f284f287936ccc2f7fb3921d60a1b566b92de", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644290911, "uuid": "d11657b3-8b1b-4d79-9dac-2bc34122e4ab", "comment": "Malware payload (Heodo)", "value": "ff43823b09d0f4e8f1cb34704a343fea29548931d13109882839257a0b882b381adb49bedc2ea02e99889d47b63a727a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644290911, "uuid": "46aec8db-c4e7-48ce-8ecd-1e30f5c7908a", "value": "T14CD38D6ABA48CA0BD94913314EE7CBF67336BC819F5297473295B72F1C7A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644290911, "uuid": "67f7a6ea-2780-4679-9f49-1de017f31b4c", "value": "3072:+cKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa39:+cKoSsxzNDZLDZjlbR868O8KlVH3skeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644290911, "uuid": "2af1076b-ebdc-47df-83d7-c92963da8d7f", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644290911, "uuid": "6b4805e4-dbb7-4de1-9ad1-584bb044ce53", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644290911, "uuid": "d7fa4eee-5395-41df-a991-96bde0571abe", "value": "tmpf7556ay1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcceb383-88e6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644328620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644328620, "uuid": "989ff636-e967-4179-ae92-44d7a19cacba", "comment": "Malware payload", "value": "8e1bc209136cc3f1fe6fdeb5b0f8a3de", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644328620, "uuid": "938de337-58f1-4ece-843d-16b3d9e49673", "comment": "Malware payload", "value": "24228b0ef9546f9743cfa0d52299e5a3cac708446235c2324d19a65b52f48636", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644328620, "uuid": "8c984b2f-ab7f-4d6e-8002-0db99167c955", "comment": "Malware payload", "value": "e406c1a1eff667d61cb224f59e827695aea43c7e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644328620, "uuid": "f347fda3-2f11-450c-86f9-6c2a35ebd554", "comment": "Malware payload", "value": "2a1e349b4cd1eaf69b37ef6c3c0b4b558881ac8ad6b4349221a7011ff2d9314a0e211f81a66bab393b6fb20eaf64f7a6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644328620, "uuid": "05504138-9904-4efb-863f-2c8491cf81ba", "value": "T1FD8175B420124734EA63C5967AB57DC57595F0E3E8E53E4893AC28E64C8CF5CFC4AB82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644328620, "uuid": "f0cce0cc-179d-400d-94db-a84d6afec5de", "value": "96:vxyGx/Bexgaxm+xhcx62xXUx7mxwKxvexIaxkixRExlsxLb:Jq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644328620, "uuid": "cddc3392-3750-4b17-bcb4-6b8cea8257a7", "value": 4050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644328620, "uuid": "b2eb963c-d9cd-4573-9614-b801e54a54c9", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644328620, "uuid": "3367575e-d5ca-4b29-a176-48bf093da0ec", "value": "cometome", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2afd3dd3-892d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644358762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358762, "uuid": "d5839cb0-646e-42c0-b9ff-905d429d3e22", "comment": "Malware payload", "value": "3c262d03676a2d1995387ce682de23ff", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358762, "uuid": "145c5796-6611-4d40-a0bf-8876783fe469", "comment": "Malware payload", "value": "242b674e04fb5a4395e4c28c9db416fad09449e76db8771788da8db88b4852c5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358762, "uuid": "53ac614d-50fd-4c26-a16d-7ac848b56446", "comment": "Malware payload", "value": "67437c5904ca7e6262dbd9288074e37e325bd4f8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358762, "uuid": "f0633b6f-e600-40cf-8924-a39f1b6955eb", "comment": "Malware payload", "value": "d7fb813ed0bd8a15439af82f705dbf7ec3a20ea6162d85bf7a2dc78def77278db5b97563a2810e7dbdd9cbf847b327f6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358762, "uuid": "9bb0669e-203b-47b4-8281-67df306e8910", "value": "T1D3C35A55F685EA1ADE0822350DDFC7F97336BC828E9683473299B32F3D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358762, "uuid": "f0eb1523-5a56-42b7-a941-6fb68141e2c3", "value": "3072:hvcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgiB3:hcKoSsxzNDZLDZjlbR868O8KlVH37kei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644358762, "uuid": "77d43f18-694a-4325-80e1-09f562d32475", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644358762, "uuid": "116057a6-60d6-47da-819d-c3b2d488e430", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358762, "uuid": "5dadbbe2-d8ba-4423-ba98-3de05f42b217", "value": "tmp91j469hi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb5fcf0b-8916-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644349126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349126, "uuid": "c0172003-553b-4a40-87e5-f59175836e7b", "comment": "Malware payload (Heodo)", "value": "d951c0d731c40859ea7e158116c00b7b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349126, "uuid": "160acadf-406f-492d-8250-7f6574779bb4", "comment": "Malware payload (Heodo)", "value": "2430c7a40974c4ecc3f32dc4106125b51b95fcfc0f1b2ae6e08f45d928ebbf84", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349126, "uuid": "91d3ebef-0c59-4331-80ff-2f17d3386bdb", "comment": "Malware payload (Heodo)", "value": "359636066d714c4c130b8bedd8f6505d2acaed4e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349126, "uuid": "7f9ac1b5-494c-4da2-ab42-28dd253bcef9", "comment": "Malware payload (Heodo)", "value": "1a168f26ac23065cc84be00f8eb8004418de1dbfd6f3a9996510b7f9a75e59dcfd390b2b5efb20602afca40c90191408", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349126, "uuid": "a9f9128d-ff7b-4fba-9489-01c189d2eef1", "value": "T18FC35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349126, "uuid": "7e0c7b87-328b-49ed-bd6e-3e7f33b8cda3", "value": "3072:h/cKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBq:NcKoSsxzNDZLDZjlbR868O8KlVH37key", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644349126, "uuid": "cd9354da-f24d-4a69-ba54-27cb28022df9", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644349126, "uuid": "ab53158e-fb39-4132-8318-16c269140c41", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349126, "uuid": "b4a39e1c-699d-4bcf-8f80-14d61d8ab606", "value": "tmp6_glhv1j", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea43b34-88f2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644333509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644333509, "uuid": "6ebbfd5d-50a2-449a-a174-0c3fcb492697", "comment": "Malware payload (Heodo)", "value": "49a6b8eb2b0926fb49048f486bbb5657", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644333509, "uuid": "fc401d54-e6cc-4049-b937-6948df7217eb", "comment": "Malware payload (Heodo)", "value": "243e8365d8d7992ee6011f32eff3d76c9a70afae4d7b5575deb949891962153c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644333509, "uuid": "a01bf6c4-8121-425c-bb5c-5ffd18eb5b6d", "comment": "Malware payload (Heodo)", "value": "3d92aa31e48d42f1eef4133b30ec2b73e307e77c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644333509, "uuid": "e59baa1a-d672-449b-964f-aaac389d206f", "comment": "Malware payload (Heodo)", "value": "21bf46409e59cea9021e87a99100e34cfc0fe026bcee4211a12ac247c75048c4306a2a2c713ad318ab6a4d75412d868f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644333509, "uuid": "1b8edaec-ab96-4d16-a58d-2cd7f3af82fe", "value": "T1C1C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473299B32F3D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644333509, "uuid": "b59b219e-9f92-4c64-be22-a5c9eccd7cb7", "value": "3072:gOcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dg+B4:ZcKoSsxzNDZLDZjlbR868O8KlVH37ked", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644333509, "uuid": "d831e7db-2ca2-4ccd-8c31-e06de9e490f7", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644333509, "uuid": "0f41bb87-d2ea-4d75-baa7-03dfcfc1a2f1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644333509, "uuid": "2e7eb597-75c4-4463-b612-b9c20c570639", "value": "tmplquy9u8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adfb6c75-890a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644343950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644343950, "uuid": "d93fe3de-5dce-47e3-9245-e064a3b994fa", "comment": "Malware payload (Heodo)", "value": "1bec314879d692fdeea2d33ea92bd60d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644343950, "uuid": "4a14af1e-3203-45f2-8537-236b3cb66774", "comment": "Malware payload (Heodo)", "value": "24535b870e3fa9cb78fb020aa0f74a2ce9af982f8c4da86872eb4aa4b276fefb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644343950, "uuid": "767219ca-05c2-44ab-a93b-b2491b3d943c", "comment": "Malware payload (Heodo)", "value": "86cc92fbba5da22554e056f738e04f33f90a2e99", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644343950, "uuid": "eb83444a-c186-4751-a86b-5a8882d5a430", "comment": "Malware payload (Heodo)", "value": "e6a67c77fc8ca68bb20f54e202996eb7e166cd96e326a4e7c5a1625161214b2503f367c0687aed2147e45c3b670bf7ef", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644343950, "uuid": "e43bfb81-e092-4a80-b72c-591a72409db2", "value": "T1CBC35A55F685EA1ADE0822350DDFC7F97336BC828E9A83473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644343950, "uuid": "d38e16ef-0f0c-4cfd-a60f-4d4b2f64b0fc", "value": "3072:fXcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgiBt:fcKoSsxzNDZLDZjlbR868O8KlVH37keo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644343950, "uuid": "a34b06a2-dfcb-4bed-9bc9-a45dad41a5d6", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644343950, "uuid": "b814d300-1daf-4b13-beb6-f2e46825d00a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644343950, "uuid": "f49abc9e-f034-4232-8dc8-782b1fc2990f", "value": "tmpwo65nx_n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35957611-88e4-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644327427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644327427, "uuid": "8887b6e1-4aac-4f46-a3ac-5aecb3ea1b4f", "comment": "Malware payload (AgentTesla)", "value": "17f3cbdb76817fb918704d247aeb9015", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644327427, "uuid": "70498fb6-e493-41f8-8853-84d1fcc28908", "comment": "Malware payload (AgentTesla)", "value": "245f10bd87db63dab02528af1be27f84be2be58aee091227a3c3b5c4373f08b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644327427, "uuid": "6427a894-3206-479c-86aa-f5c5584c1061", "comment": "Malware payload (AgentTesla)", "value": "50c5e4fa1905957c8d5f008207366d6a041d1e96", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644327427, "uuid": "5ee4b33f-67c5-4d40-9dc5-7860449b3916", "comment": "Malware payload (AgentTesla)", "value": "12b347c87394272a296b73f20563f1edaa4bd6c94e5f1e7a360fa74219a302a67f6c0f0ce8821eff578b294118cb6774", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644327427, "uuid": "bbc10b98-e2a4-40c1-90e2-7b9991006a9f", "value": "T151C35FF4E770B919F010C97CF99982703AF8EF605F329542B469763A197E2BC2D624E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644327427, "uuid": "670e1809-5c5b-41f2-ac13-2596d6bba15b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644327427, "uuid": "c8a18266-dbf1-42d7-8d92-715ba8b5d43a", "value": "768:1xc26b+oIGcezZ3maHiYMwN8Agw3nZPHbzYKg:zc26b+oIQ2NAVZDz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644327427, "uuid": "483196fd-c86a-4f86-a2a0-2143bf4e22f7", "value": 125440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644327427, "uuid": "f649ef77-c714-441d-93f0-eace8ca61dcc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644327427, "uuid": "a4798f6f-6af0-49bf-ac4f-9d089ab93c5b", "value": "DOC30222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873585fc-88ac-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644303512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303512, "uuid": "76ae66c6-7f46-4d2f-9c97-c7e71f53fde3", "comment": "Malware payload (AgentTesla)", "value": "66d945f8466b1aa2b89aeddb96883d14", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r16", "colour": "#C18C8A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303512, "uuid": "f30c21f4-b1be-42ae-b9e7-3a1b46b54a99", "comment": "Malware payload (AgentTesla)", "value": "249950d03089abfbdcba97a805d224e83c8670734649e5da92603ea7ebbac55e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r16", "colour": "#C18C8A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303512, "uuid": "005abf5f-0558-4950-a17e-73d4c188b083", "comment": "Malware payload (AgentTesla)", "value": "985e5aeee2f1ba6a7f41bec9d9889a58d075e780", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r16", "colour": "#C18C8A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303512, "uuid": "49fde816-08d8-43b8-8400-52d148ffe915", "comment": "Malware payload (AgentTesla)", "value": "848ce363c18816878835bcdad41f233ba7fb6babe0f78eecc94a53ed4dcbfebe34ad47daa09e94c5e7cd993096790aa1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r16", "colour": "#C18C8A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303512, "uuid": "49e1880d-53d7-444f-bae5-f3ccd206c6d8", "value": "T16C4423E1B5C9035999549E45CDCAF9332327E494C4F37A99BAFDC62E2023C61C84772B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303512, "uuid": "d3100602-38a6-4c73-aa2b-5a20974d4983", "value": "6144:GDQtrTaSd2tQNSkLXne08TeLjPFLeTKWvG6OZmaedqmP6q3:GSaZcTneheLrBeTKF6OZXedqmSq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644303512, "uuid": "c316c262-284e-4456-a172-15f9fe463675", "value": 276662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644303512, "uuid": "a0315f10-ecb2-43be-a152-4ccd13f8dbe9", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303512, "uuid": "e1b07084-29a9-4cc9-9e01-7309395f9889", "value": "New po docs.PDF..r16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de2b528e-887d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644283472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283472, "uuid": "e1584467-3a3c-457c-a3b4-aa156e2100b8", "comment": "Malware payload (Heodo)", "value": "44d60446d8d97e70ed796214b73c38b9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283472, "uuid": "85cd1b47-b772-49b7-bbc0-e79e84491eca", "comment": "Malware payload (Heodo)", "value": "24a397182e8db482dbf657dd204af371b850fe9bc9528c8e9b49981eb374c903", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283472, "uuid": "c2439b8f-8c50-4be5-9af0-8990e3b8cb46", "comment": "Malware payload (Heodo)", "value": "5934275b2d07a535653d13d147dffa5bff56cf34", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283472, "uuid": "ca7c0451-70b9-4427-9d00-ffd278e9a6c3", "comment": "Malware payload (Heodo)", "value": "2d8546595848faf1f50a510abb888c31fa1cb315b10ac6f5165e809185300b847fc80fe31cca2211cb1d57a21802fe1a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644283472, "uuid": "0cf344e4-79a6-4f2d-beea-3a68ca536ac2", "value": "T1A493F15D3E1C790BE1D7E338DF38E96052651DE07291B8B960A0BEB9123C453C26AF6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644283472, "uuid": "a3c02fe1-b7b2-40e2-b2d5-217ab7f50a29", "value": "1536:zZRiRVqdJuMgHUVSKa3Xm1WBXz7yL64i+kkfa+3gtfvjHtoxzg5bjIFL5:zvAVqSqa3Xm4nC5X5gxvhoxzMI55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644283472, "uuid": "33d8e1de-1806-4b78-bc7e-9a60b258686e", "value": 94230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644283472, "uuid": "f0bc3155-4144-403a-b3de-357472dffc01", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644283472, "uuid": "267bf89e-13cf-4206-a013-43ea9e78f050", "value": "tmpxzmnk0tg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05df9278-8925-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644355264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644355264, "uuid": "4af6b3f4-1069-4327-87fc-e7be3f750c1d", "comment": "Malware payload (Heodo)", "value": "a5f8123e4974501fade6bc4ab5984abf", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644355264, "uuid": "249d9010-2d05-42c8-83df-d6b0c496c555", "comment": "Malware payload (Heodo)", "value": "24bbd759bf62ea7ee388415b252376a3fb41dc972e9ebb66efbd0869e2a89299", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644355264, "uuid": "2fd1843c-3f2a-498f-9b31-f7f49d5f0109", "comment": "Malware payload (Heodo)", "value": "e95c1df751cda76251a0856ef0ddce10069239f6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644355264, "uuid": "fc80b37f-844b-4cb1-b50d-c7f994cb0740", "comment": "Malware payload (Heodo)", "value": "a967e2454694f535f02dc649ba05c7fa117687aaa1be571cc75fc6462d7c7cf7afd91654d34f02d0e12f80d73f010264", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644355264, "uuid": "a1b49863-f44f-46e3-af75-3d879db377b7", "value": "T116C35A55F685EA1ADE0812350DDFCBF9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644355264, "uuid": "50ce9ee9-9385-4811-8673-761336282647", "value": "3072:s7cKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBO:0cKoSsxzNDZLDZjlbR868O8KlVH37kei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644355264, "uuid": "e0455147-417d-4d36-b23e-4f23df5dde94", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644355264, "uuid": "9fd8d912-053b-4399-ae60-aa2bfa35b63b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644355264, "uuid": "98d02445-b617-4b50-b906-5f3b348ea0c3", "value": "tmp1wf53zv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea8f460-88fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644338448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338448, "uuid": "f97cd6d6-bd66-4381-a9b2-43efddd2aea2", "comment": "Malware payload (Heodo)", "value": "ede01f57f257b1598a8415c96444d684", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338448, "uuid": "51f01f42-85cd-49e9-9acf-17ae91914703", "comment": "Malware payload (Heodo)", "value": "254d2e4a31e39ad8eedb16c6f1764e4b333b8183fb3a34dad32bec1bf292fbc2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338448, "uuid": "c1ae11db-83ad-4328-ae85-28bbf3afc860", "comment": "Malware payload (Heodo)", "value": "1350e1a99ec348b77628bec6a86dcb8f268d05f9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338448, "uuid": "63a76088-83d1-481b-8ae5-3e33fc00aa22", "comment": "Malware payload (Heodo)", "value": "5b49517f349943e4b57a3af33bb890e49ea7a559de9f2678d587a89b99ce078ea946e2ad5c828413da93755734940fc0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338448, "uuid": "fde6b7c2-f04c-4bf9-8900-ee40918bc8d4", "value": "T1B2C35A55F685EA1ADE0822350DDFC7F9333ABC828E9683473299B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338448, "uuid": "9281ffc5-8490-4493-a39a-ac6105317228", "value": "3072:5LcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBU:9cKoSsxzNDZLDZjlbR868O8KlVH37keA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644338448, "uuid": "cb8ddd50-4e3f-460a-941d-e287cc664775", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644338448, "uuid": "0f3c5fbd-ef04-41d5-91f7-2ba1e70c491b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338448, "uuid": "fadd7ccc-8b3a-44fc-9a3c-596188574fcd", "value": "tmprx4_ofmm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc91ef3-88f7-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644335896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644335896, "uuid": "dc65fd38-985f-4343-aa87-09f3a9de1cad", "comment": "Malware payload (AgentTesla)", "value": "b78bc74479e83b85e81ea148f95a196c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644335896, "uuid": "9159b1ba-6ee7-4854-b891-09d13779e941", "comment": "Malware payload (AgentTesla)", "value": "256a2c966d64b385a03f31c8ef604d83632650a9cedaf51a99bf0483fa650f24", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644335896, "uuid": "26c29280-6a3d-4522-bbf7-41e69c356582", "comment": "Malware payload (AgentTesla)", "value": "0005285920af618a0b6683c79fcd38b3ab83295a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644335896, "uuid": "578cb6bd-745b-4440-9d58-70dec323f954", "comment": "Malware payload (AgentTesla)", "value": "42b685f6d4969ec9fbe771bb399e4aef3f9d267697958f39fe9f5089be38e826e1d97ce49fc1823c5e167aa8ba7be4ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644335896, "uuid": "1485568f-95bc-48dd-99ee-d615a0eb2e20", "value": "T1162420A5EB50F85EEC25B039D461E4F81AF36C31D584E60F185D3D6A72B234310AEA6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644335896, "uuid": "a4565a37-70c2-4815-a099-071f99216c0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644335896, "uuid": "a8307f1f-1fe5-4cef-8ea5-4cdf3014b75a", "value": "3072:V6b5UMd6ogU7UUBeEGkBHUUUecLMNmttnYBYeSsj6:YbW/vhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644335896, "uuid": "73a87d50-bf64-411a-9295-092566a7158d", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644335896, "uuid": "b4fc71df-bfc3-4fa2-8265-4571bace8a3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644335896, "uuid": "496f1dc7-ecb9-48df-b376-7a9595b9c383", "value": "nueva cotizaci\u00f3n y confirmaci\u00f3n de los productos adjuntos##.xlxs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2148384-889d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644297249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297249, "uuid": "aa6ea74d-b8dc-4ab9-afa6-ff22ddbabb85", "comment": "Malware payload (Heodo)", "value": "0195db6dab97140181601751b824cbaa", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297249, "uuid": "28e35f66-de05-473f-bbe9-fe9086115e21", "comment": "Malware payload (Heodo)", "value": "259eba3b623e1f7f3c8012cb2e57225ef4555dbe2d2f07e154735bae6995a1d3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297249, "uuid": "9068755e-72fe-4564-aa46-5d3ecdd387c9", "comment": "Malware payload (Heodo)", "value": "8db39e29e6bdb4b5ee71f21836569669573bea8e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297249, "uuid": "f4ba4329-6d8d-4cfc-837c-2122633aa00d", "comment": "Malware payload (Heodo)", "value": "e61ad7203afc7fa53811cc39fc10bc20fb24e9ab8312ca458cdc071f57e2f6bdc5c96a4b782dea6843a348208599ee07", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297249, "uuid": "09bad414-321c-426e-86a0-96ab457cf78f", "value": "T127D38D6ABA48CA0BD94913314EE7CBF67335BC819F5297473295B72F1C3A581CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297249, "uuid": "a5228df9-0488-4130-96d8-87ab3c39fba7", "value": "3072:PRcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPaZ:PRcKoSsxzNDZLDZjlbR868O8KlVH3sk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644297249, "uuid": "5d87b43c-9706-49b2-96f5-10bc0001a252", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644297249, "uuid": "5122b197-8761-4088-82f3-3a7e10602f0e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297249, "uuid": "74ec3eb2-298d-4a82-9a68-9f712eeaf549", "value": "tmpg_l4cb89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb82ae15-8931-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644360803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644360803, "uuid": "a09eab67-efb1-43fc-a1f8-7d0a64fecf14", "comment": "Malware payload", "value": "0226ed26e9c360db287a4181f5b85d5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644360803, "uuid": "11b32348-b59f-4a13-b571-3108255cb495", "comment": "Malware payload", "value": "25c9e75fd1025e1f2adfed454c1fee4b8197b3b7851f91eafd5b913b63e44332", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644360803, "uuid": "3bf9bc8f-b944-4512-98e1-5940daec0d60", "comment": "Malware payload", "value": "4dc0fbaa9a16e23df70bae9412d8fc116d96fd91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644360803, "uuid": "4bf09c5f-21f7-49db-98a3-2cc8fac90cfa", "comment": "Malware payload", "value": "33b4285f5b161292004ece47ed693e1970123034f2d166898b2a60073c936beb16d50a5b9a7a4ad6735e1216714841ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644360803, "uuid": "31e7391c-1692-4a14-b960-24f1261746fb", "value": "T1D6848D06E652C03CFEFB04B8D496CA66ED5E3A24169D619F63413A6D32613CF123F52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644360803, "uuid": "2ed54e02-7b80-4177-83ec-e1533e5bd541", "value": "79fb40281049052b3e354a6e444da473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644360803, "uuid": "46fad9b1-002d-4b0b-834a-bc6b2b1d10cd", "value": "6144:O56dLjBFLyztOoeeYIjAmkB8lebi9JqGXdZ32mneM0laNUIbeURK46:YszuzNFjWB8f9JqQ2mnB0l4UMK46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644360803, "uuid": "3354b65e-8ec8-41f8-84ef-b65aec59d1e1", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644360803, "uuid": "703cb15b-f221-4247-a0a0-f375d311f5ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644360803, "uuid": "0c52178c-c938-4d2e-a537-bc777ecb104c", "value": "0226ed26e9c360db287a4181f5b85d5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87053d91-88fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644338301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338301, "uuid": "6ce2575d-2524-470d-a97c-05463ea0b6e9", "comment": "Malware payload (Heodo)", "value": "2587f1f8c39dd6fcbb58368155ff07cf", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338301, "uuid": "28c88f9b-a770-439a-834d-8f4eb3d31db3", "comment": "Malware payload (Heodo)", "value": "25e262825d874a97bf5152e82c2ac859a6d7bb1d515d95ba3428fdeed1028917", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338301, "uuid": "fe3cdf14-b580-4d8f-a03a-29647a6d530c", "comment": "Malware payload (Heodo)", "value": "695cb6c04d1081a99296e78c48e617b3d59c3ce4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338301, "uuid": "f5f30045-8183-4cad-afff-8c76146f4fa1", "comment": "Malware payload (Heodo)", "value": "21201211f9bab21fc0d434ba882c5fd4f8659ec50ec53c7b6777fb221f09ed82450bee9ce524e4799fd1822cead4bdb3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338301, "uuid": "c2424ded-7bf3-4385-ace9-9af97992677f", "value": "T12EC35A55F685EA1ADE0822350DDFC7F97336BC828E9683473299B32F3D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338301, "uuid": "c4f21b43-c210-47c5-8a6d-2af0327d1bb7", "value": "3072:fwcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dg+B4:ocKoSsxzNDZLDZjlbR868O8KlVH37keN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644338301, "uuid": "60102d86-2488-468e-bb8a-17aeb1fc18cb", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644338301, "uuid": "3983f5fb-7f46-4fb5-9d68-9f5d1bdc5522", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338301, "uuid": "418b3534-dfd1-4e42-9044-259e42f211d7", "value": "tmpjiegp5kr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34cf6646-892c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644358349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358349, "uuid": "0f87a632-02dd-413a-8f02-79e84411465c", "comment": "Malware payload", "value": "412bb65052527818e6a17886b50c3cc8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358349, "uuid": "38d81b3a-eb1f-4321-adcd-eb50cea99602", "comment": "Malware payload", "value": "25ee5a0264146304a025034972267713a7810b9759867ae7e272edad48ad983b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358349, "uuid": "a2471a01-9a39-47f2-9f22-d930bbe11193", "comment": "Malware payload", "value": "cf2e04fd53f2118d833e3e16c6e81e8850efcdb9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358349, "uuid": "2a501ce6-3d1a-4811-b18f-354bde8e40ee", "comment": "Malware payload", "value": "6009aa9aac7ca94dca9026cef8a746f27883a15f215489b1d60db97557c4cf323d49352bfc7a795ab5ea2d59d00a8e3b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358349, "uuid": "a2489b3a-f08f-4591-bc99-784f98c9a6de", "value": "T1F3C35A55F685EA1ADE0822350DDFCBF97336BC828E9683473299B32F7C76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358349, "uuid": "cb7d247b-6b45-4692-971d-2a051defb4cc", "value": "3072:PXcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBj:fcKoSsxzNDZLDZjlbR868O8KlVH37ke7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644358349, "uuid": "ecc03d6a-0086-4789-b655-67ecde385cc2", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644358349, "uuid": "12f30195-42fa-4a20-964a-c53e1541611e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358349, "uuid": "338a66be-5e66-49aa-ae25-3164f1ddedd8", "value": "tmpxola6vnp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a97a521-88e2-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1644326630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644326630, "uuid": "969db8c6-6c6a-4b21-ac3e-6375b1d74945", "comment": "Malware payload (Gozi)", "value": "99eb077df2ad3f8678d7d80e0b240682", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644326630, "uuid": "3f275230-1901-4b7f-a1fc-ee6f6866e831", "comment": "Malware payload (Gozi)", "value": "2603f6890e3c3d47696b37c47516ac2e9f35e6805653f467a0a22de2b88defc8", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644326630, "uuid": "8ec5e058-ce89-4e11-8435-2644df19e497", "comment": "Malware payload (Gozi)", "value": "302f8aa0b2c284634a06098c9a8f0a81ea10e402", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644326630, "uuid": "32bab229-1017-408b-83b7-3976abf2a78d", "comment": "Malware payload (Gozi)", "value": "6a9c9d4f58b54c5b9c1098d435a8e44c7d335181d0cbf670326ba6e723ee36b535e105a27b107f59fee5a34b67d7c349", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644326630, "uuid": "75a442d3-5238-4057-9724-756a398dfd5d", "value": "T16BB4BF6372CDEE26E759153D7A9403F29D41F409C73984E7E9A0B49A9089FBA0DB0FC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644326630, "uuid": "23e4d21e-e45a-4bba-8b8e-c4a902f54ece", "value": "9224affad59e38bb713e15dad5464671", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644326630, "uuid": "cfa69da0-a7c9-420b-b657-ff17ea047448", "value": "12288:vF8165G8Ku+u5S8TAkir0ejSrAJ+nxI6bj7nR66WbFznwt9fjd1c/Fb35vaqsZKO:vFgg9Ku+uzCFn2xI6bj7nR66WbFznwt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644326630, "uuid": "5dc18245-c80c-457d-8ce5-9632c3ea0573", "value": 515312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644326630, "uuid": "dbe929dc-351c-4a2c-9204-e3f42c4779d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644326630, "uuid": "eff2af3e-7604-42a6-b0c0-d4ee9c5017c7", "value": "image.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d781221-88ac-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644303388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303388, "uuid": "fa900b80-ca2a-4e75-94e5-cb0ad14c637d", "comment": "Malware payload (AgentTesla)", "value": "7a7ba9c52a9c30fdb357f7fc55554953", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303388, "uuid": "c806f1c7-9650-4c9b-ad1c-929274c10cd7", "comment": "Malware payload (AgentTesla)", "value": "26062f43d8837331813cbd3c932a5e5d5c169aa9eef50aea4e79ea13431e791d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303388, "uuid": "9a2384f9-7c83-4b8b-91ab-b9a0704be30c", "comment": "Malware payload (AgentTesla)", "value": "16c3dfa4f811e11234847ee1b05b3ed993bece4e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303388, "uuid": "6b44d911-4d70-4a48-a21c-a7eef300a040", "comment": "Malware payload (AgentTesla)", "value": "6cf3f061309efc0428b968f64e032d91ad638a2d6c40499e372cb26949632db15236e34a83302430ddc5c003b39b972d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303388, "uuid": "d9713a02-3c00-4511-a872-1e340ab9196a", "value": "T1C2C34EF5E774B919F010C97CF99982703AF8EF609F329542B465763A197E2BC2D220E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303388, "uuid": "f1dc0125-7508-45d4-ae15-585b6fe80085", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303388, "uuid": "49a191a7-5ad3-4738-b334-f6f09edf7651", "value": "768:33tCpIpYezx3maHiYmwN8Agw3nZPHbzYKI:HtCpIx2vAVZDzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644303388, "uuid": "5113bd50-55eb-4cb3-a4de-bac6a6b982c3", "value": 124416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644303388, "uuid": "df25b4d8-2980-43fd-961b-e38320ac30a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303388, "uuid": "1a195de6-5a14-43c7-ac09-b6e28f98575a", "value": "\u7f8e\u91d1\u532f\u738728.84 (USD 40,257+5% \u7a05\uff09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e055b6a-889e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644297403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297403, "uuid": "777d387e-2ca0-4d4c-9de8-3538f4e3fb4d", "comment": "Malware payload (Heodo)", "value": "8ca645f7fb40bb806a5d0bc536b44076", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297403, "uuid": "a3b7bc6b-043e-4abc-9153-5bd26601bb32", "comment": "Malware payload (Heodo)", "value": "260d84c2c93d002505432777983bef83a3c7114cbbbea49368d2b3ca59e6fb32", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297403, "uuid": "25624e37-83fc-43e0-ba1f-a2115eb2fc9d", "comment": "Malware payload (Heodo)", "value": "fb1fd205d17cd80ca1ebbc637f91fe7d55e04e55", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297403, "uuid": "20751e50-ad7b-46bf-8cbc-da1706d4acc1", "comment": "Malware payload (Heodo)", "value": "e6303aa06ef377153f4a0ee9271f8cbb926bbd022e9a1681bc5922b471b7e0bc3bb620c9fe1a069eba0849bd5f4e5e96", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297403, "uuid": "dd9863bf-ba6c-4241-9ebd-42ae91ac8ccc", "value": "T158D38D6ABA48CA0BD94913314EE7CBF67336BC819F5297473295B72F1C3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297403, "uuid": "f7efa020-07df-4313-a799-4135d61ea19d", "value": "3072:e1cKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa7:e1cKoSsxzNDZLDZjlbR868O8KlVH3skx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644297403, "uuid": "e71c4075-7bcc-4d48-86dd-b80d475271bc", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644297403, "uuid": "c92be23c-9446-4239-9277-bf816b626123", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297403, "uuid": "0f0fc594-e3f6-4db5-93d7-10178cd8e87a", "value": "tmp2qyyrz3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d5aaf52-8919-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644350176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350176, "uuid": "6d4e4320-a7d5-4323-ae6c-3cd774656ac3", "comment": "Malware payload (Heodo)", "value": "b63fab2e75f67fc10808981da020059e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350176, "uuid": "87b3074b-9488-4f8b-bfd2-51f698bca153", "comment": "Malware payload (Heodo)", "value": "26231abd3ef52baa6a60112248dc402305a9bd75bcdfd2f5bb2f5d2e10a5c064", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350176, "uuid": "ff3b1f3e-ba1b-4c83-ac28-289a510a1760", "comment": "Malware payload (Heodo)", "value": "8f749fa86d2ea717c0b12aa9c47916a7b17e893d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350176, "uuid": "5ab2d902-4751-46d2-81a7-6b0519aead2d", "comment": "Malware payload (Heodo)", "value": "43ddf07de46fe200e1199804b739d1459ee5ac1458cf1cce35ffafb4e23776972d91132451a70b9415d6206fda6b5cfc", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644350176, "uuid": "3774cd6b-7411-4cd8-8b5b-2fefa9c591d9", "value": "T18CC35A55F685EA1ADE0812350DDFC7F9733ABC828E9A83473289B31F7C76550CA12606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644350176, "uuid": "9c04a300-63cb-428a-833a-379ad881f279", "value": "3072:sFcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBo:ucKoSsxzNDZLDZjlbR868O8KlVH37keQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644350176, "uuid": "9d6a170d-cf0d-43bb-8377-161aafd55e7c", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644350176, "uuid": "4a6e2447-4008-4d4a-83a0-3d5980009d6f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644350176, "uuid": "f1603dcc-8822-4f60-af4c-936ca5ad4648", "value": "tmppjw1elhu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "201faefc-88b5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644307205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307205, "uuid": "dddd6a1f-fc6c-49f7-b190-f4c671527a68", "comment": "Malware payload", "value": "10df17519f772be3543abf3cf142bfa9", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307205, "uuid": "13d46dea-cb89-444a-b7d4-a9c95de3d974", "comment": "Malware payload", "value": "263e812d5fe7c5529e9146b7b1d5f20d5c7adad7eaa8a0ce329b1182b589a71f", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307205, "uuid": "39591baf-73a3-4bb6-bea8-7d6fd435151e", "comment": "Malware payload", "value": "e467f55cd224f8410030581cc7858b824a7ff843", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307205, "uuid": "462656ff-7c03-4e1f-894b-c02ff523c851", "comment": "Malware payload", "value": "eb0007b87efbeb0629f2fa84ff8f2aa1bf3ac0121c53bfb7a147565fbdd540dabd122cf6da97e37dbf2f6fee97ea6d87", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307205, "uuid": "959700c0-ce9b-499c-90e3-7fbc49abae46", "value": "T13416335055C013CAF698DD1E17EC3B35523FEECF2878AEE3955283F1040EE89DA6265A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307205, "uuid": "9c33bbb1-6cd1-4800-8182-47dabc71c38a", "value": "98304:G1wwAjzIQOMK2GNKslgus10Y1/UJ7BdlRbTBAlYVP:G1wwAYBr21uQsJ7vTBAlYVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644307205, "uuid": "76973dc9-ff4a-4428-977f-41c46f3c221a", "value": 4063232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644307205, "uuid": "999d35c5-794a-46f2-ab2d-f41e22468ec0", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307205, "uuid": "11ab44c2-e187-432a-b88e-b78e06ee8113", "value": "263e812d5fe7c5529e9146b7b1d5f20d5c7adad7eaa8a0ce329b1182b589a71f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5655f1-88ec-11ec-9275-42010a9c0029", "comment": "Malware payload (sLoad)", "timestamp": 1644330879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330879, "uuid": "1abf4472-98f5-40db-b82a-bce60db23cb1", "comment": "Malware payload (sLoad)", "value": "6449ba492ce34af559141df37e41c9f0", "object_relation": "md5", "Tag": [ { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Pec", "colour": "#50C7DE", "exportable": true, "hide_tag": false }, { "name": "SLoad", "colour": "#1A35A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330879, "uuid": "ee154608-e92a-4ab5-b31c-8c89b68dfb6e", "comment": "Malware payload (sLoad)", "value": "267a0f244d1d0d21b306ba31de5c42223508e71228c06d7396af9f9811cdc5dc", "object_relation": "sha256", "Tag": [ { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Pec", "colour": "#50C7DE", "exportable": true, "hide_tag": false }, { "name": "SLoad", "colour": "#1A35A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330879, "uuid": "94553d74-b577-49cd-a71d-73b54deff04b", "comment": "Malware payload (sLoad)", "value": "1b83c90059bc7a751e62635b05c9f2d5436f5065", "object_relation": "sha1", "Tag": [ { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Pec", "colour": "#50C7DE", "exportable": true, "hide_tag": false }, { "name": "SLoad", "colour": "#1A35A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330879, "uuid": "dbd085ba-dfdc-422d-a19c-1479e26c8a96", "comment": "Malware payload (sLoad)", "value": "926d02257ed88bf49ae2c82be423f3bacfded074b66bc698736954d953fc999a94d0443f095186be15f6973f1b9f43c8", "object_relation": "sha3-384", "Tag": [ { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Pec", "colour": "#50C7DE", "exportable": true, "hide_tag": false }, { "name": "SLoad", "colour": "#1A35A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330879, "uuid": "6a6198c9-97c8-4bea-91c9-364b73b7f070", "value": "T1DDF0E14811A5C4CF754775E2A471949DDEE845BAA179E7EA20D0940D1011EA833A145B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330879, "uuid": "9f41f78d-8941-4c79-97ea-c3bef6978acb", "value": "12:nTWljjhKnd0ajtHopkBgjEz/WFbmwLzyT2xWd039JdHVEn:naljUndPRHGPjEz/WFbpo2xWdQ9VEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644330879, "uuid": "a5d7c9e3-c626-482b-9696-0a8b3130396c", "value": 578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644330879, "uuid": "b7753a8a-7b09-4038-8285-9f8a9d6f47e2", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330879, "uuid": "11c03834-4f38-4efc-9cf3-a6505fd26527", "value": "Leggimi.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84aec0f9-88c8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644315534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315534, "uuid": "6c06d2b9-8c2c-4846-ad8b-c659ba6321ad", "comment": "Malware payload (Heodo)", "value": "b76d6a95815b1975378d087f74cf4a63", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315534, "uuid": "530497b8-6548-4eed-8a68-2023b1370fd9", "comment": "Malware payload (Heodo)", "value": "268636d52d3fa499bff6e8f2b9583aa5d7dcf7d7584f309e37dc5716541527ad", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315534, "uuid": "1f240f07-b620-441b-bed3-e293b055b093", "comment": "Malware payload (Heodo)", "value": "c5611cd4216f14471809d3287648f182ce1ef57c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315534, "uuid": "d780aaaa-9c34-4f53-a1b0-0e3152b16a00", "comment": "Malware payload (Heodo)", "value": "a21692e95bd1d6005415e34d624979db1425608316236f15177c298a400dcd2382d9d1a8500d14967a45badd9bb2c5e8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644315534, "uuid": "7bf6f10b-6205-4639-859d-df9f3cd43bf1", "value": "T1F393499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644315534, "uuid": "fdeaede4-b9ef-4c8f-bf20-239e6bfa0a29", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644315534, "uuid": "a56adedc-0924-40ca-ac7d-7a06a7f6dcb0", "value": 96550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644315534, "uuid": "e5cd9ec2-6488-49f9-992c-a88d9b6fdd4c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644315534, "uuid": "55ddd619-4e6c-4015-8e8f-4b88b817e584", "value": "tmpw3oeun1p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6c1cca1-8937-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644363372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644363372, "uuid": "9abc8c4c-4193-4429-a682-ecf85bd993e1", "comment": "Malware payload", "value": "18b828deb6c95bf0623fbe87c02dc6b0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644363372, "uuid": "b8d414fb-2325-4618-826b-e51b44e83af1", "comment": "Malware payload", "value": "26b2334b85e41f3022978bf858addcf79db2661b9627389133b0defe8294368f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644363372, "uuid": "0f8321c9-91ba-42bc-affa-2720e3230497", "comment": "Malware payload", "value": "a4e4c55bfc02d2072cd1df7456332f379c4e9e25", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644363372, "uuid": "d8ccfe59-3ba9-4fe8-8a59-d670fafbc4f0", "comment": "Malware payload", "value": "50dde03cd1d234f6be728a4058f40fde8588457d57d77e78f41480d5e524b0feedf15b4cc0b53a6b083e4f78300d36d8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644363372, "uuid": "a8d7adad-5b28-41ee-ad4f-03e152b07010", "value": "T121C35A55F685EA1ADE0822350DDFC7F97336BC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644363372, "uuid": "6188423b-dfa5-4ee5-803c-aed49a0c090e", "value": "3072:oXcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBg:ocKoSsxzNDZLDZjlbR868O8KlVH37keE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644363372, "uuid": "1ac893cf-f013-47a8-a65f-31bc0e489bec", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644363372, "uuid": "44da71f4-bd47-434e-b878-805c875861c5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644363372, "uuid": "841a9827-5b12-4fbd-b073-51f400674804", "value": "tmpx6ju8ydz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8636caea-88f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644332716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644332716, "uuid": "3dcbbb3c-4319-441b-90e7-326779185167", "comment": "Malware payload (Heodo)", "value": "b49cb9951d9efc769e3a7b226691fbf8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644332716, "uuid": "600e06f9-a3d1-4817-a66f-aee2c463b366", "comment": "Malware payload (Heodo)", "value": "277f92346c4c4821eac67542890991e8412a5b9b9296adbc9f3a41780e4be9fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644332716, "uuid": "3b5b59e1-0a0b-4885-9599-8070c590d894", "comment": "Malware payload (Heodo)", "value": "06e129ad8b9c013ec2936d1811c7b91f5517adee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644332716, "uuid": "1716a23a-8270-4a86-b321-9dffcbfcaf1b", "comment": "Malware payload (Heodo)", "value": "8c8e86da4ca9452e44afa39ebda3c2adfce8bf68af1888b9ad3479210cf84645fa6ab454c336695cfa55bb2326947d2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644332716, "uuid": "bc193d14-075b-4829-b408-52fce573a5f7", "value": "T1DFF4C0006582907AE4F930B842667BF1E93D1CB0372511D39BD069FEA6E41F1B6B376B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644332716, "uuid": "eabe1ff5-3926-4eb0-9673-330c3d10015a", "value": "36d18f8cb3bee16af0421e6a936157a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644332716, "uuid": "9a4d122c-9560-4b0a-a4de-4913856b3384", "value": "12288:lBseOTwOg957PAMTEFv49thrFcmxLFwD7wGcXbtzbEOpUDlBgawsoei4:keOTwOUPnTC49LJxJwaCOpUD7zoei4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644332716, "uuid": "9adaecf4-5bad-46a8-a07d-2ff817c7821d", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644332716, "uuid": "fa33449b-0560-4892-9583-acb43b974ca5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644332716, "uuid": "9e6f2182-062f-44a4-862d-cef2bba0b99a", "value": "b49cb9951d9efc769e3a7b226691fbf8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "491f6ec6-88f2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644333473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644333473, "uuid": "122ae883-9017-4f81-872c-551f0253edd2", "comment": "Malware payload (Heodo)", "value": "df7908660561c31158e1b5efdb76f879", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644333473, "uuid": "2f7f7744-1f00-4d81-bf3c-40030b96b5b3", "comment": "Malware payload (Heodo)", "value": "2787bc27a6f3cf72160af23d2ef5fd62c6b1e55d501332b52101aa35612db08d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644333473, "uuid": "67cb61ba-10b6-4cc7-b9e6-c164a75a5ad1", "comment": "Malware payload (Heodo)", "value": "c28e22efb004b7d410794105f858ec023689d926", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644333473, "uuid": "cf25d86a-a1c6-4005-8065-fefee316e61e", "comment": "Malware payload (Heodo)", "value": "8d04625d4c91c0daa3ab8591f08afacde56d92880ac40d13272cbe80be4cbb9c7d910bdce8b4a4b93f36804abf2f34ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644333473, "uuid": "382c5733-969c-428d-ad10-19e58edd834a", "value": "T173F4C0006582907AE4F930B842667BF1E93D1CB0372511D39BD069FEA6E41F1B6B376B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644333473, "uuid": "b1a1042b-51a5-48bf-b360-16b1aa8753a3", "value": "36d18f8cb3bee16af0421e6a936157a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644333473, "uuid": "811645b8-330b-4701-a732-f0372ce2283d", "value": "12288:lBseOTwOg957PAMTEFv49thrFcmxLFwD7wGcXbtzbEOpUDlB9awsoei4:keOTwOUPnTC49LJxJwaCOpUD70oei4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644333473, "uuid": "a1d3f0ed-23c9-4dbd-a1a3-92cc45b23bb0", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644333473, "uuid": "6c88a64e-8dc2-44fe-8002-4e6283503665", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644333473, "uuid": "c5aaac1b-6538-4910-8773-19ca8383521c", "value": "df7908660561c31158e1b5efdb76f879", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f4621e-891b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644351082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351082, "uuid": "56f693cb-1956-46fe-8eb1-415295046a67", "comment": "Malware payload (Heodo)", "value": "be2fc3e089a1b7cad68c51fae3949381", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351082, "uuid": "43cc0e95-718f-46f1-8664-2ff025ddd181", "comment": "Malware payload (Heodo)", "value": "27907f19765b66e2d69188be6f59ebbfd89e1eca51227d0362e8047211254634", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351082, "uuid": "c9d3f3f5-c6db-4a98-8fed-45aaac3fa54e", "comment": "Malware payload (Heodo)", "value": "9170c662dd6a9de96422d7529495457ac386b8a9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351082, "uuid": "bf1f638d-d411-4e50-af25-3402df4b9704", "comment": "Malware payload (Heodo)", "value": "27f184fd6bdd0a8625aebf45911c50a4c097f17c9e7560955a942081ec04cc284f55fc68729539664d518b238dc140a6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644351082, "uuid": "e4085aa8-c879-4d78-b2b2-b316b2492d52", "value": "T15CC35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473299B32F7C76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644351082, "uuid": "935c6bef-c403-4d97-9040-99329126ccc2", "value": "3072:3PcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBI:/cKoSsxzNDZLDZjlbR868O8KlVH37kew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644351082, "uuid": "e75b29a2-1158-4705-b7f1-97b7419bed72", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644351082, "uuid": "5340de8b-84ee-4e10-95f7-504559315f4e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644351082, "uuid": "86ccd6c3-5aef-4b04-911d-5d99b64d4313", "value": "tmp5rxi6xtv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d02bc83f-88bd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644310936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310936, "uuid": "96572323-3fb3-406f-b563-a8c85f4c76ed", "comment": "Malware payload (Heodo)", "value": "dd9d34aebe2aaf8d9b30fc74afc2dedf", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310936, "uuid": "a341a2c2-a1d5-480d-b71c-b4e564e8ccff", "comment": "Malware payload (Heodo)", "value": "27afa0fdb0300916cf2235e9576d6923c955feeed49b7323804deb64ad4f30f6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310936, "uuid": "79744632-c885-4f2b-a5a1-d845c4ec2957", "comment": "Malware payload (Heodo)", "value": "f8c54f85d38befc9081dc076a57540886841d9e2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310936, "uuid": "c962fcf9-6b73-4112-b980-9216c015a7ce", "comment": "Malware payload (Heodo)", "value": "e9cfbfecb19f669cbcf5046d0cf1024fae4a86d5ef81c53086ade5a2ce50c0184c0160fb6260ca14028656a0b9030a62", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310936, "uuid": "1734dcd1-5400-48fc-8c61-2db9e4f811b0", "value": "T18FC36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310936, "uuid": "7b77f45a-cdec-4833-9a86-ec38a8722a62", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644310936, "uuid": "af797bad-d3b8-4e8c-99a3-65557b0ac3f1", "value": 127634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644310936, "uuid": "a198ff66-c7f2-44eb-b3ed-14e4d9dc54ca", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310936, "uuid": "8ecdb4e6-0e68-4aa9-9c13-14093dc1ec17", "value": "tmpdl7_tsw4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d6778e-8901-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644339881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339881, "uuid": "ddc775c4-7173-48de-af5f-0cf966c82caa", "comment": "Malware payload (Heodo)", "value": "4e4a72f855004172a3eb46f902a91001", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339881, "uuid": "95a63a82-bd7f-41d2-873b-73dbadad9399", "comment": "Malware payload (Heodo)", "value": "27c041b67e36b9551e81b67b61cab12d82756a7697de660be4935d4ea3042ad1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339881, "uuid": "1c5fa5cb-696d-4581-912b-6b3f6c7772a0", "comment": "Malware payload (Heodo)", "value": "5ff2604943319fd6179ecf99b01657c12ea9b3c0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339881, "uuid": "6c6d9a83-ab6e-4617-a47c-ccda071c73b0", "comment": "Malware payload (Heodo)", "value": "dd606e90fbbe2a4c6d04f8eba15bab0d49e022c495b8ab34ddc1e0973d462ef136f7c4a85287a8fa47e8c6013f32e622", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339881, "uuid": "823821ef-3b98-40b7-bfc5-f1ab9553d2a3", "value": "T1B5C35A55F685EA1ADE0822350DDFCBF97336BC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339881, "uuid": "f8324a08-0f6b-4d1c-9729-1863da23187d", "value": "3072:MBcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBj:ScKoSsxzNDZLDZjlbR868O8KlVH37keH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644339881, "uuid": "43c42c86-a05c-40af-b662-e1a59fc5590b", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644339881, "uuid": "8e1cbe16-dd46-4138-9f24-b073335d23d8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339881, "uuid": "a5674d36-6a4d-49c8-8fe9-c12f369c1948", "value": "tmp0i5pj7do", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc30751a-88d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644321694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321694, "uuid": "57beb1c6-f1f2-4269-b4c3-e2aa7839c160", "comment": "Malware payload (Heodo)", "value": "86ec657228132245b99907e10920bd48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321694, "uuid": "b36c9bc6-f755-45e7-9b6a-c5f98f4b0888", "comment": "Malware payload (Heodo)", "value": "27cf0e72b0be7c61dbedc21fbf7006fd01d660e7e6d41b41073c427323269bbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321694, "uuid": "d7c20f62-cd88-43f9-a80f-a96d3c860598", "comment": "Malware payload (Heodo)", "value": "80a8a2fcf7add7d1ae0fc8e1ee6744c6e722fe7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321694, "uuid": "6c931848-ad49-41b7-82f2-40c156dc3733", "comment": "Malware payload (Heodo)", "value": "59146b3b5097bae36bd2eda1a35d11658be7eccdc8054b38bdb616dc37b19ade856e34005d7407f6b96840b912af38d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644321694, "uuid": "7811ba29-193a-49ba-9c2f-d3201055fd04", "value": "T17EC43A12AA82B0F1C79C813EB3F97AEB903F146547AA76D34FB18C8965EC0D119F7911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644321694, "uuid": "bdb179e6-f9ea-497c-b8c6-19327f0dd432", "value": "1059dec3a72d4c311e39c8fc33d5af98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644321694, "uuid": "abe9332b-9259-492a-a6cf-9d20f1325749", "value": "6144:PQXvqLl4JINqB9QqbJq9AbuR/RzZ+fR+c96lnVPk5XtlOkiETHyROnR:oXvQDQVq9Ac5ZuRX6lRkzloEzyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644321694, "uuid": "fe7ea643-2996-4db3-b2d2-4bc5eb1cb85c", "value": 596992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644321694, "uuid": "95fa9e1f-bab1-4101-b806-f86fa9b935d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644321694, "uuid": "09cf03d1-7e7d-4938-923b-7a375d365853", "value": "86ec657228132245b99907e10920bd48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82425746-88fe-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644338723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338723, "uuid": "0b4f458f-a258-4fd7-b1c5-186f6826402e", "comment": "Malware payload (Heodo)", "value": "c552b5b1a406ba751cbe637c27781291", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338723, "uuid": "76e7ed0a-d282-48c8-9389-b4e67623055f", "comment": "Malware payload (Heodo)", "value": "27d7ce6ae1f4b95c4b0f3e683b7a174a14e65d724a3efa639630ab6fd49e5efa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338723, "uuid": "9e79c7d8-8f18-4424-9bcb-671ca14eae90", "comment": "Malware payload (Heodo)", "value": "96cca68ef5a4f0dd33df23f670af4fa9a4e90295", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338723, "uuid": "be4e71ca-b94c-400b-b8a2-091026ffb0f4", "comment": "Malware payload (Heodo)", "value": "50b58ec9760b2806e1d3398ed460fcc21103d2ffb5a549e3b894fd2eebd642a5285ffd60788711f8f716e9705f139f87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338723, "uuid": "472fd586-3156-4d95-8733-df4a2ee0a42f", "value": "T160848D06E652C03CFEFB04B8D496CA66ED5E3A24169D619F63413A6D32613CF123F52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338723, "uuid": "ed7d5064-8b3a-4ffe-bffe-834fe83921f6", "value": "79fb40281049052b3e354a6e444da473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338723, "uuid": "09db137b-7bfb-4588-8777-022c184e4169", "value": "6144:O56dLjBFLyztOoJeYIjAmkB8lebi9JqGXdZ32mneM0laNUIbeURK46:YszuzNwjWB8f9JqQ2mnB0l4UMK46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644338723, "uuid": "154787eb-c7ce-4843-bcca-554ae24f652f", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644338723, "uuid": "17cefffc-5dec-4336-892b-846776af0f44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338723, "uuid": "cbda1b7e-6c9f-4e21-a16b-4781213f477a", "value": "c552b5b1a406ba751cbe637c27781291", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15513e15-8918-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644349707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349707, "uuid": "361ffdb8-4e10-4721-8212-230cac4ccf75", "comment": "Malware payload (Heodo)", "value": "d15a7e58563ae4c8b6d2da2fd3c7f519", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349707, "uuid": "16596a70-d7e3-4212-b603-4b2b8a19191d", "comment": "Malware payload (Heodo)", "value": "285f58eaf2fd8d31dcdbd7ef0db09d7cebc395af7d0495d9ffb1e8f4d12a2720", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349707, "uuid": "796515e6-b96f-4838-9dfd-43fc0c0999a0", "comment": "Malware payload (Heodo)", "value": "2b354593a7c2168e26d1430661f4a3b247e11026", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349707, "uuid": "a13a93ee-5aef-4677-9695-e9e39138618a", "comment": "Malware payload (Heodo)", "value": "54e6f273469172a6106f7965b77168bfa1e3045602a5ddd53fb165d92b15b17c12ed1d62530a6853a9754402c2ce26cd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349707, "uuid": "823f9501-03cf-49c0-a621-71ff58061fa4", "value": "T160C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349707, "uuid": "d19f0048-7288-4dcb-b401-dfd40f2353c2", "value": "3072:lxcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBW:jcKoSsxzNDZLDZjlbR868O8KlVH37keu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644349707, "uuid": "e7ea2e2d-1d96-4a15-aa65-ccd18e7c027b", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644349707, "uuid": "66c915de-bb5c-47ab-b76d-e2714454fa11", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349707, "uuid": "d0a103da-eda1-48dd-9daf-32ddce17ef18", "value": "tmp0yybbq8v", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908a0d9c-8918-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644349913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349913, "uuid": "d4ef328a-3bf9-4628-96ae-f965edd03abe", "comment": "Malware payload (Heodo)", "value": "c750cb37d150f69056aaba2b58adbccb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349913, "uuid": "38a5fddd-8288-4bf0-acda-2ffd6b97bd4e", "comment": "Malware payload (Heodo)", "value": "28805ea5636d602bb29d328c8821da96c940ffe7f612c871d52c8941dd325498", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349913, "uuid": "3cce13ed-123f-4537-87e9-e613614656cb", "comment": "Malware payload (Heodo)", "value": "af842ef25cc8c08a3dcc07b0f63fc370c04441f6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349913, "uuid": "c7720b52-561e-4a0c-8fb1-07bed98890e3", "comment": "Malware payload (Heodo)", "value": "cc24df6990bc805ac9fd3ccecaf50d1e8deb085e57a7a54712167af54b64e9998e61d721292e5dfb9b953907750053dd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349913, "uuid": "e6d490bd-19cb-49d8-bbc1-423d27ede0d8", "value": "T17AC35A55F685EA1ADE0822350DDFCBF97336BC828E9683473289B31F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349913, "uuid": "f3d0be94-32fa-499f-8deb-23612550fa19", "value": "3072:4RcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBI:icKoSsxzNDZLDZjlbR868O8KlVH37keQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644349913, "uuid": "6322c747-d6dd-44fd-b2ba-80cd4c00da7f", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644349913, "uuid": "be0d6534-a0ea-4a1c-b610-ff65800afe07", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349913, "uuid": "0098cfc6-7d9c-4bb3-b136-eb3fde2d245a", "value": "tmptq3jmgw7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff359cb3-890e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644345804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644345804, "uuid": "a6fd8213-5680-486d-b24f-2cec6a3b06d8", "comment": "Malware payload (Heodo)", "value": "6d5d8a608cc16fe9f4b2fd94bc86fad3", "object_relation": "md5", "Tag": [ { "name": "5", "colour": "#9EC247", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644345804, "uuid": "dffc9164-b3a8-45cf-b917-6281a0fc9f7f", "comment": "Malware payload (Heodo)", "value": "2894a106e42bf7a0baead2de321fc7f32d6921184499adee8931828576db5871", "object_relation": "sha256", "Tag": [ { "name": "5", "colour": "#9EC247", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644345804, "uuid": "162178bb-8f60-4aaf-b236-493e8a9d1c2e", "comment": "Malware payload (Heodo)", "value": "9b4234635087e6185320c1893bfa5f6b6be26986", "object_relation": "sha1", "Tag": [ { "name": "5", "colour": "#9EC247", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644345804, "uuid": "37dcb135-5363-4ea1-8e1d-8c777b50a794", "comment": "Malware payload (Heodo)", "value": "bd2b20fe4fa1700da73e518394ccc713400dbebd8530aef18f34c1723adf24598ace4765936171d44f4099475a6bc0ff", "object_relation": "sha3-384", "Tag": [ { "name": "5", "colour": "#9EC247", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644345804, "uuid": "d92bd2ab-739e-479e-bca7-5c7c2c66835c", "value": "T177C35A55F685EA1ADE0823350DDFC7F9733ABC828E9683473299B32F3D76550CA12606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644345804, "uuid": "20f9d436-9ac2-40a4-bec9-c44a5e4eb45a", "value": "3072:3jcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgiB+:TcKoSsxzNDZLDZjlbR868O8KlVH37ke/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644345804, "uuid": "e1a813e2-ed98-4649-9fd6-fc73eed704be", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644345804, "uuid": "c6ef3f1f-a5a3-454d-9182-0eefe30b81aa", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644345804, "uuid": "563c0595-288f-466c-9967-1d9d9525a2fe", "value": "tmpeawim8_h", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b62803b-8938-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644363622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644363622, "uuid": "34096b33-6517-4861-ad27-1d8e91d34db2", "comment": "Malware payload", "value": "651bcd04fd6efadac68c171d100d72df", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644363622, "uuid": "49371384-d17a-4228-82c4-0f34269f0c19", "comment": "Malware payload", "value": "28ba4abb428f49b08c4222c88bc8deefc3cede8ff0a414ab1bdb6e1a98b5ac4a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644363622, "uuid": "487d87a8-e8fd-41d3-804c-d662284f9bec", "comment": "Malware payload", "value": "30b8ebf1a9abb21e2c7d6e7039e3de3d88fa5f13", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644363622, "uuid": "ab3cbc46-78aa-4c71-a91b-cfbf1bde581a", "comment": "Malware payload", "value": "c2f1843581ff1019f4bb7ad64c9b64c4e6629528d1922c33a97ba1f47ee2a7ee0ed24ae0d09389e3fa8bf81e8e40730c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644363622, "uuid": "97ed2133-cd4d-4652-8ac5-5a686661eaa1", "value": "T1DFC35A55F685EA1ADE0822350DDFC7F97336BC828E9A83473299B32F3D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644363622, "uuid": "69a1ae3e-337f-4650-bc67-46ad341ee019", "value": "3072:mTcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgiBI:CcKoSsxzNDZLDZjlbR868O8KlVH37ke1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644363622, "uuid": "0af3fa61-7175-42a0-80b2-2ca642c7d288", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644363622, "uuid": "f2d17929-e8c3-4784-851a-bc95ba0021c0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644363622, "uuid": "c9884123-a030-4abb-a269-162bafaa0616", "value": "tmppk70e357", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28147825-88c9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644315808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315808, "uuid": "a1dad20d-1ca4-484e-acf1-692348971d10", "comment": "Malware payload (Heodo)", "value": "e0ef63ef0a4c0f5552407ba625869994", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315808, "uuid": "a07cdb18-5a44-47ed-97b8-8bc21a4a0792", "comment": "Malware payload (Heodo)", "value": "295919ed58e2be4c45d014d44910553a0b6481e94b162a0cf4edeaedc8687559", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315808, "uuid": "c36ef9bc-aba3-4339-851f-453c719a2d1b", "comment": "Malware payload (Heodo)", "value": "e423f7f1191b97c9743d8cd54efab1bf2539f22b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315808, "uuid": "10cbac44-31e7-4681-8972-3e0310947182", "comment": "Malware payload (Heodo)", "value": "605ba75e6300d4ace5c0def8271cd4ba7ad2d7c10491a3309bb13d1a1f1c94d7703a013bb33a35c4b04de7dece5495fb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644315808, "uuid": "69ac7c0e-55e9-4e42-9db8-37b92d7da993", "value": "T16E93499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644315808, "uuid": "32777455-c106-412d-88f8-77bf0bff1879", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644315808, "uuid": "3637996b-b3b4-4e36-bc82-384abdfc9c56", "value": 96776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644315808, "uuid": "c08add96-bc29-46b5-a39c-800f704e5644", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644315808, "uuid": "8a41408b-74ab-4a23-a786-b3d7650584de", "value": "tmplwtuvt4o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0fc5612-8877-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644280846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644280846, "uuid": "126858c5-55f2-4087-a49e-9d56a1e8fd08", "comment": "Malware payload (Heodo)", "value": "12bf5183515b9abb17e7fb54238dd826", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644280846, "uuid": "242e61f2-3a77-47f7-85ee-480cedb93473", "comment": "Malware payload (Heodo)", "value": "2983ea25829a49d09cea682f6bf5267bbcf65119a4627cb6e5e181564d6a7a5e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644280846, "uuid": "89142e76-91ff-4bf9-a4e4-ce2ea8885947", "comment": "Malware payload (Heodo)", "value": "863917a45230b5a115e5b90bc5c5ee3af196eae3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644280846, "uuid": "55a10fe7-15d3-412c-806c-bce921c0a328", "comment": "Malware payload (Heodo)", "value": "f92a814bed8617a8d165b24a10d701457f81888aec8b82e1d3bdd07a0bb5ac2c8c3113d2dfad9253d13fd2a5da7ed95f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644280846, "uuid": "1e2a6234-1919-4b1f-9a06-c3c680da3c24", "value": "T195D429AB3A8FA1BDF17B017A6350FB44E4D27C1A9FBD25D70A86358893F2D054F18A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644280846, "uuid": "4e6307a7-cc27-4dd8-a1d5-3817da76e0e8", "value": "bf1ebe22ec6f51f906ec295a3a5c6d92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644280846, "uuid": "dff07f89-3fe1-4c74-8211-8e2ffe1c996f", "value": "6144:x42k6LwFPw91EDbkUE39P7pyADYzqlEDFmZ4s3wADXcvIpxUIVZFoEXlbeZhp4ga:x409qDb109PdyOYzq3V3fVbeFTi40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644280846, "uuid": "8e54ded7-e009-4f54-96ab-00a4a4aa72bb", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644280846, "uuid": "87744333-df81-47d0-8133-29c9d295760e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644280846, "uuid": "a6c6d2c8-509f-4650-8842-7519e1fccb4f", "value": "12bf5183515b9abb17e7fb54238dd826", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef958d2-88ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644330100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330100, "uuid": "4a6b1675-faf9-4afa-849b-9276c84a27de", "comment": "Malware payload (Heodo)", "value": "09afbf981aeb373a6b066d8f069fa7aa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330100, "uuid": "0058674c-1c25-4c07-b1ed-2fa15f524454", "comment": "Malware payload (Heodo)", "value": "2992db599f59f60da2644743ed08e60e2c0f4b1ea12b3255ca4852bf650ec9d6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330100, "uuid": "1f44ec57-92ae-48fa-8f1f-9e95df147b3d", "comment": "Malware payload (Heodo)", "value": "41c1e06b2b6ccc249f3181d5550dd30b0a014afa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330100, "uuid": "6bfe3aa9-6447-4c29-83bc-8ece82b8fa51", "comment": "Malware payload (Heodo)", "value": "3153aa5171b1cd78b0a051a39fadd1da9fc831b93c4fc58b41c405e0de2627128a3044a861009f128ce806fddf1fbd20", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330100, "uuid": "8eedf153-2764-46f5-b6d4-f3cda0bf4607", "value": "T163848D06E652C03CFEFB04B8D496CA66ED5E3A24169D619F63413A6D32613CF123F52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330100, "uuid": "6a39f53a-9ed2-456e-a0d7-c708b081b019", "value": "79fb40281049052b3e354a6e444da473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330100, "uuid": "2ee6313d-84b9-4c21-b2b9-f79acdba21cc", "value": "6144:O56dLjBFLyztOojeYIjAmkB8lebi9JqGXdZ32mneM0laNUIbeURK46:YszuzNejWB8f9JqQ2mnB0l4UMK46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644330100, "uuid": "6b7b3ec0-fafb-4c70-9346-bc194e70bf08", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644330100, "uuid": "a8252137-45fd-4ba5-912b-9c407b8d3b46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330100, "uuid": "b06446c6-3996-4cc2-99ee-23c2ad63197f", "value": "emotet_exe_e4_2992db599f59f60da2644743ed08e60e2c0f4b1ea12b3255ca4852bf650ec9d6_2022-02-08__142127.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7857a4-892a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644357428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644357428, "uuid": "8cddaae2-9122-40e3-ba8e-76cb0c5a7832", "comment": "Malware payload", "value": "666f6ade01f395b1d0fd0c912b991597", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644357428, "uuid": "5a163270-a0a3-4f9a-a0cf-32c851c3353d", "comment": "Malware payload", "value": "29966493cad9ada79d02154a8d03ea481a441d5f767ffb226021ca13699b13e0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644357428, "uuid": "e8f35c38-15b7-456c-a1da-2cf86062b07d", "comment": "Malware payload", "value": "0a2e0016632a95e4ad11f1d3286461aa42193362", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644357428, "uuid": "085544b0-bb4c-4dcc-91c6-3ea525ec43b3", "comment": "Malware payload", "value": "0ca5ae7b9aa41bdc360c557b928ff73ffbd95142c8e97edde7f01d4847de769dd4b6a11d85d0b5ff8347497eb36ce5fb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644357428, "uuid": "9289bef9-2088-44a4-a42f-1e52cd1895c3", "value": "T16CC35A55F685EA1ADE0822350DDFCBF9733ABC828E9683473289B31F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644357428, "uuid": "d68f2ee4-3fdd-4f7b-9b4d-d008e1f79e7a", "value": "3072:fccKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBa:UcKoSsxzNDZLDZjlbR868O8KlVH37keC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644357428, "uuid": "25058b05-9fb3-4b61-967a-70c99e06e888", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644357428, "uuid": "8ce7a8a2-9e98-41d7-a6c3-f282e4c25fe1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644357428, "uuid": "242b7ecc-075e-44e0-a28f-cb7e8f66b5ff", "value": "tmpecyf6zle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dfc4b23-892f-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1644359761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644359761, "uuid": "0b885d1b-a64f-43f3-a2fe-016896879c50", "comment": "Malware payload (RaccoonStealer)", "value": "9581807e44614094b42b235db963fdbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644359761, "uuid": "be443ed2-02f2-45cf-8a62-c704c758d158", "comment": "Malware payload (RaccoonStealer)", "value": "2a3b5d211c1926990b33553ca2d9f490167d4a0a73e96da9de8f79fdb814d66c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644359761, "uuid": "34a4dfa5-9a84-40b2-a45f-76d6b5336655", "comment": "Malware payload (RaccoonStealer)", "value": "fb8b76895a58835da6db6a9a4b36fbe22b27429e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644359761, "uuid": "0d7cd121-e051-49b8-abcb-ed543c166d02", "comment": "Malware payload (RaccoonStealer)", "value": "624cbcac0e41b2c8a1c16285c0c2b207bd5f673cd9ca0f86a70af81d37da8ea6550ac970dcf824870af62a9980915a96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644359761, "uuid": "1fb22fde-3a64-4800-869f-e459736f93ad", "value": "T125D4D01077A0C039F5B352F499B99278B92F7AE06B2491CB43D527ED96399E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644359761, "uuid": "76a618be-c497-4f42-aab0-f8427dbea8d7", "value": "e12c52f1062cf23fa570efddb059bf61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644359761, "uuid": "ffc0a54b-7ba0-4916-8318-df8c8573ce09", "value": "12288:RVSZ6SSrlnMTCCdXGVNjWegbnM5EPkJGPUFzwxwU24Xs9qyZ/m:RMZ/zntGjjWtbzUFgXtmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644359761, "uuid": "ddd7f68c-04f7-4dd3-a0a6-5ffdd3bf59f4", "value": 598528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644359761, "uuid": "55e2b3eb-f9c9-4f47-99e0-59567dc1e2d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644359761, "uuid": "8eae8043-851e-407e-8b1f-22478b94cce5", "value": "2A3B5D211C1926990B33553CA2D9F490167D4A0A73E96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d26162d-88b5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644307388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307388, "uuid": "1885f0b5-3ada-48df-a78f-65c0aa81a783", "comment": "Malware payload (Formbook)", "value": "ef9b78996bb6c66aed20f4cf1732d7ee", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307388, "uuid": "3f2542ef-ec67-4674-afac-2db32e3f5a1b", "comment": "Malware payload (Formbook)", "value": "2a82b0745643842db5f52f326458581377bb6199594665a28a9f4bdbe8530369", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307388, "uuid": "306991dd-c382-4e22-83b8-073b57495ac7", "comment": "Malware payload (Formbook)", "value": "f3c8d553f59836e386580dc92d309a3151e6338e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307388, "uuid": "5e9528aa-206c-4f31-8454-0bed77f36d0f", "comment": "Malware payload (Formbook)", "value": "7d4f78c79033e0aa0422fa51aab79fbf6620050a42423eecae075046e7bb1df59ea74d565d1317c261a51eb633d8a986", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307388, "uuid": "3d185d5c-78d9-4b86-8998-a043fe5976ec", "value": "T10F1402C47D9287E1E652B6FB0320AA3789769E512C53F672D21D332935BCD1213363AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307388, "uuid": "8081572a-b7d9-4672-9d3b-025602fc4390", "value": "3072:HxBsKNSv2vUGQfB8A9XeHezpFLzorvsuXBM5y4QB/bkpsdw8B+YjEF4r8i+xN6ER:wKNslHMHezpt0Eu2y48wpsdX+224raxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644307388, "uuid": "237ec590-249d-4fa7-a97a-52fe1bdbfaf3", "value": 191848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644307388, "uuid": "064fdaad-f001-4bbc-8bd2-1e58414d0cf0", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307388, "uuid": "214b52a1-e248-42b6-9140-2529ee3b8c6e", "value": "AB_WYSY\u0141KA DPD.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ccd0f90-88c3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644313400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644313400, "uuid": "63062db9-29b2-464c-87b3-a46fb76b02c3", "comment": "Malware payload (Heodo)", "value": "3e9e36156abcedc1cca70d4b85e81715", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644313400, "uuid": "42cf3b11-4016-4c69-8245-6b16daebd098", "comment": "Malware payload (Heodo)", "value": "2aa088e9b8311f778e4b104efee3913440c05e7f93f1a0e0a37bdf4e586abd68", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644313400, "uuid": "f8430d87-a6fc-41e8-a280-8f360294637c", "comment": "Malware payload (Heodo)", "value": "7ecedaceb20ccf8dd3f93c2f8313c387fde0317a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644313400, "uuid": "34a2f2a5-70a8-41cc-8665-ae323751f996", "comment": "Malware payload (Heodo)", "value": "761a80fe39cbcd931b236bd4cc7d438abe1edc9bb404171b5e8d59ce21bcca3e74ed21506e65e9983bebd4ca29efdaed", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644313400, "uuid": "ad3d2615-ac5f-411a-ae59-f996907e4efe", "value": "T1EC93499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644313400, "uuid": "540acc10-cb3e-4b8a-af14-c81c4499b227", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644313400, "uuid": "f920934a-a63d-4051-a73f-3e723c3ee6c4", "value": 96648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644313400, "uuid": "7b07ed94-ace7-4987-b218-1a9f0ef995dd", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644313400, "uuid": "98f85de0-cdf3-4694-9a3d-b7c00f2e292b", "value": "tmpxg8vv51y", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2bd8385-889c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644296740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296740, "uuid": "336a87b1-2642-4201-96e5-111831225cbb", "comment": "Malware payload (Heodo)", "value": "ef4eb3bf1ada4ac62473ad69acf5832f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296740, "uuid": "49e8ec5e-4385-4365-9a1b-1bfeede2211a", "comment": "Malware payload (Heodo)", "value": "2af727bbf035cec4b4a4c764721d3d2b33930e1e83ff182429d4da50db88f95b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296740, "uuid": "4f53a541-fd44-4d60-96bf-59adfdc814ea", "comment": "Malware payload (Heodo)", "value": "2b5424fedbed69a275e1325d9c7881628e86c43c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296740, "uuid": "863805dd-90e6-4052-8ebb-a6209f0d84e6", "comment": "Malware payload (Heodo)", "value": "8fe668ea1b75c5fb1b4018861b20ead5d5ef7c2324da6c21c081a4b8170478ed6c46debdd4b9897f9571870a9c5f83d1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644296740, "uuid": "43c658a5-77bc-4726-bcd7-f177ade7d143", "value": "T1DAD39D6EBA48CA0BD94953314EE7CBF67336BC819F5297473295B72E1C3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644296740, "uuid": "bb5b8665-a2d2-4048-b3b5-c582ead0b8a4", "value": "3072:GcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3F:GcKoSsxzNDZLDZjlbR868O8KlVH3skew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644296740, "uuid": "3f109403-fda2-46a9-a18e-a742683a72bc", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644296740, "uuid": "caa6b508-5a5a-4e8b-9e6a-2b9560def4ca", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644296740, "uuid": "6c831540-25f5-4999-a7b4-3b9b8837665f", "value": "tmpc941du3l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8e1345-8926-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644356051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356051, "uuid": "f03dfba5-9bc2-4696-ae2d-ec428740c5db", "comment": "Malware payload", "value": "e5780c506f675dd958c0ef6b5544ca81", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356051, "uuid": "19d5c556-5276-4c00-80a9-8e8a55c2e53b", "comment": "Malware payload", "value": "2b25b5390f981f4a6d8df60054ed58c6e952620a219245b60f172d9ef0432e92", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356051, "uuid": "106ddb0c-77e2-4750-9cd3-9912663f1755", "comment": "Malware payload", "value": "df0d4e8d5f82550d1f6b3bbf575489ae43fcedd5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356051, "uuid": "1e664585-12c1-4ebd-a8ca-166d82d95705", "comment": "Malware payload", "value": "b7b2e3409aa10e718503fa0002bb5ac7d78635b6522e1be36256b183025c3ecc692f898351ddf1d7f8bae80cf1a41d1c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644356051, "uuid": "d2319bce-8735-482b-b292-07b8dbff2897", "value": "T1FAC35A55F685EA1ADE0822350DDFCBF9733ABC828E9683473289B31F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644356051, "uuid": "54ee7a3a-551e-4358-bcd7-8bc70e52f1de", "value": "3072:NAcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBt:icKoSsxzNDZLDZjlbR868O8KlVH37keV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644356051, "uuid": "c4fe967f-f871-4367-a8b1-dcc650a9eb3b", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644356051, "uuid": "38d41c36-1178-413e-b289-8828fc26bb7b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644356051, "uuid": "17cc27ce-281a-45f6-8dad-9c43c6c45874", "value": "tmpd2m1eisz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1fd9b7-88fe-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644338848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338848, "uuid": "a8ff92f5-4b3d-47ed-b33d-e948e94736cc", "comment": "Malware payload (Heodo)", "value": "9d26efbd16ca3fccd6a15bf06f2924b0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338848, "uuid": "134ddc61-75d2-4fa5-af3d-52a0e4469125", "comment": "Malware payload (Heodo)", "value": "2b3a5501acbb30e5857db62f5eced0bfdb3fc21e771e6fa9bd97eedeab063d20", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338848, "uuid": "9a04eefc-45fa-434e-83db-a08a38478833", "comment": "Malware payload (Heodo)", "value": "3d4d4d75d6b0a882b9ce2d540511808567539179", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338848, "uuid": "b5c8ef6d-345d-42be-ba81-63594639d58a", "comment": "Malware payload (Heodo)", "value": "86c7c1749ab764d926bd8f6c484052e1552c849485deface3c275b4b1222f181ae234fd871db69d6ae34a705e06bbd39", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338848, "uuid": "a320b7f6-65e4-45da-83f2-93c232170c26", "value": "T175C35A55F685EA1ADA0823350DDFC7F97336BC828E9A83473299B32F3D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338848, "uuid": "7a94c7ea-34f7-43e7-b08c-ee726802f49c", "value": "3072:dycKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dg+Bx:AcKoSsxzNDZLDZjlbR868O8KlVH37keE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644338848, "uuid": "e51bc972-5c9a-4da7-b32d-5aa858bec6b6", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644338848, "uuid": "d318b29b-6592-4383-a534-1db923e89ff0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338848, "uuid": "71df6932-9f6c-45b4-81fd-63dafa77c3af", "value": "tmpiapcbuoe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1490dba-8900-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644339687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339687, "uuid": "73e32522-147b-4bce-bdc5-0cfd1c46d829", "comment": "Malware payload (Heodo)", "value": "1e039f30ae282f57fc45ed4bfa82310e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339687, "uuid": "f0a81682-d331-4469-8e05-f91fdba2263f", "comment": "Malware payload (Heodo)", "value": "2b40859a4c2913166b3ef6d30d12faf386e78fac58b1691b837cc54e9a460a12", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339687, "uuid": "fbd98c85-4264-42d6-9f02-3945068c38e8", "comment": "Malware payload (Heodo)", "value": "1395008f6d28ec790d7cb812ef88518f72b7bd30", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339687, "uuid": "071ed282-d585-445b-8a58-216bd5bca9ed", "comment": "Malware payload (Heodo)", "value": "d24ae43af45ab43558fb41959f39b2c59846f8d113e1d705109ed1f37612de97e53ac22a9f22c59af222835e3ffc2f11", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339687, "uuid": "e3d5b74c-0b45-452e-91ff-c64ac4fff8d3", "value": "T164C35A55F685EA1ADE0822350DDFC7F9333ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339687, "uuid": "56e63a2a-aa3d-4bee-913a-7ee28aef3cb0", "value": "3072:ZQcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLB+:2cKoSsxzNDZLDZjlbR868O8KlVH37keK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644339687, "uuid": "bad3cf44-991f-4f44-b17c-af95e6e0b2f9", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644339687, "uuid": "9260a3dc-f66f-4ade-83c5-82f75fa9c5b6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339687, "uuid": "166b1c8e-e054-4fdf-a133-8c88b7e92ce5", "value": "tmpqufl4n48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d0b7afb-892f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644359732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644359732, "uuid": "550d00f3-f4f4-495f-af5f-2bc28b121673", "comment": "Malware payload", "value": "c9b445c1ce02f6933561b8fd20d6f163", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644359732, "uuid": "77360919-6793-495f-9ae7-ddc73d8db20f", "comment": "Malware payload", "value": "2b43c1bf648c197c1ed122a0c46bd74a7634d514ae1fa1398532ca73da3780a8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644359732, "uuid": "77725e4c-0b19-483f-9db4-8af52eb17b88", "comment": "Malware payload", "value": "f4f9d2d0f8292475c3f370e439df1c178d6ebbbe", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644359732, "uuid": "ca138164-361e-40a4-a7f5-ef79ad0763d1", "comment": "Malware payload", "value": "fd803b9221a1d6a50941d7dfdd90538e8d350f93c073064256325c641f51e8288992a96ccab844e04a2fab7af8d5a655", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644359732, "uuid": "15258dcd-4852-4198-a15f-33f6d7355692", "value": "T126C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644359732, "uuid": "24100025-3b0a-4757-882c-847f6ad56707", "value": "3072:+QcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBy:FcKoSsxzNDZLDZjlbR868O8KlVH37keq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644359732, "uuid": "2cb604f7-5415-42cc-b47e-e370d6d6ac20", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644359732, "uuid": "1a6684be-7ce2-4ea5-8656-cc5581555d16", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644359732, "uuid": "aa66df2a-53c4-4af2-bad3-8c35c29b9a67", "value": "tmpx435q6mt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b673b6e-88c2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644312968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312968, "uuid": "b2baf7bd-d32e-419c-a6f4-946efbce836f", "comment": "Malware payload (Heodo)", "value": "2ed638677c4959a7c8804553d9644aa6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312968, "uuid": "9eb7b635-279a-4d61-b228-6704b6be19e5", "comment": "Malware payload (Heodo)", "value": "2b44c739ec20e4ac36522d505b9673a8f1959f9f3e7ac4e06a13ddb374806d2c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312968, "uuid": "373948c1-ed29-44ed-844b-0711eebbc25e", "comment": "Malware payload (Heodo)", "value": "608aac0c7ba31b30f9617a815dc3305638890cf5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312968, "uuid": "e7e3bca4-062b-4b5b-b7cd-b6b9f1d67a6f", "comment": "Malware payload (Heodo)", "value": "d93c80dfb3ec0a094fcfe7ca70ea6a7ceace770949effee79f1bd18a104b8e44f158111dab5a271cb39d9f0df1e29a25", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312968, "uuid": "dd38debd-97d6-42e0-ab10-d1d42b4f74d6", "value": "T17CE306439948EF6BD128D7F8BF570EA81B0B6B09E18636EE04625C4F7F6576109CE06C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312968, "uuid": "7c4ec109-a4c7-4013-85df-11913d4379d0", "value": "1536:1UlADSJ2HXsoq/NAo//////////////////////////////////////////////N:AADSJ23soqlOojn+DU3pzUbjWXF/K0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644312968, "uuid": "e46c8938-e1fa-4790-896a-92507941b8a1", "value": 147188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644312968, "uuid": "86062cd0-4602-4098-b038-df42c9e30ff5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312968, "uuid": "6bc33790-d598-4eb5-b027-7647293c7fe4", "value": "Message-07022022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53078d1d-88c8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644315450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315450, "uuid": "99a38133-09d2-4314-af38-7bd0eef1915d", "comment": "Malware payload (Heodo)", "value": "284e2317f41a7ec9df2fa41e76100473", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315450, "uuid": "5ea64f4e-e8be-4d87-bc0b-b6eb06b42918", "comment": "Malware payload (Heodo)", "value": "2b891a310939c786aadf743d3272b5b61d719ab70fe069a9d9d1fee907d59047", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315450, "uuid": "88b0ed84-c323-4b83-82cb-e28609ad2b8e", "comment": "Malware payload (Heodo)", "value": "9a3eb5ad8120bcf1f06afde2647f1fbde81ff46d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315450, "uuid": "2cfd3c47-8982-4a75-9fa8-a1af8a858912", "comment": "Malware payload (Heodo)", "value": "589001cf47b4fb98e285ed733b11a2fc571caddbd48f4a5c13645dd84a88c7375eb64a75c9fc132a07e20dbf9efe1437", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644315450, "uuid": "1a709348-eb81-4a64-a9db-971f595965ea", "value": "T100F4C0006582907AE4F930B842667BF1E93D1CB0372511D39BD069FEA6E41F1B6B376B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644315450, "uuid": "81272fa9-dc1a-40bc-98b5-7cdbcd01b262", "value": "36d18f8cb3bee16af0421e6a936157a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644315450, "uuid": "960d6469-1ca9-4904-806a-889fe3d6e2b9", "value": "12288:lBseOTwOg957PAMTEFv49thrFcmxLFwD7wGcXbtzbEOpUDlB6awsoei4:keOTwOUPnTC49LJxJwaCOpUD7Foei4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644315450, "uuid": "b6a1a6fd-875d-4acd-b268-6b35fd9d2619", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644315450, "uuid": "8517c600-859d-4525-b918-aefdf4686af2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644315450, "uuid": "5147e4a3-dc6e-4227-acc7-d0387135d98e", "value": "284e2317f41a7ec9df2fa41e76100473", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76638be8-8913-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644347722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347722, "uuid": "e0d2aac7-564b-4734-9eb2-cd599919c820", "comment": "Malware payload (Heodo)", "value": "8d7f238050143a35324c2efb2546512e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347722, "uuid": "7ee583b1-d533-48e2-87b0-dbcf0d00c4d2", "comment": "Malware payload (Heodo)", "value": "2bd25d0e7c64457f1f22b6eb91d95a74fc358c80f53197bec5d45844055c1c1d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347722, "uuid": "3e1a1680-29f3-4ac5-b0fb-87e54951cf34", "comment": "Malware payload (Heodo)", "value": "affdd7fbeb36032988029b2fab51f94bd82c82f1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347722, "uuid": "f296e0f2-fb8b-434f-b3af-c46348be43a1", "comment": "Malware payload (Heodo)", "value": "deaa98da4fdb4589854f6ddc0ff41a7ec0b2b58cca8b9f081de803e709f90e9a168869e0488528efefec9f5337baffb1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347722, "uuid": "9505746b-0303-4c7d-a100-288598a035da", "value": "T1D9C35A55F685EA1ADE0813350DDFCBF9733ABC828E9683473289B32F7D76550CA12606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347722, "uuid": "1afc01fd-e954-405a-b6f9-488084845077", "value": "3072:YvcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBn:ccKoSsxzNDZLDZjlbR868O8KlVH37ke7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644347722, "uuid": "a7f915ee-8866-42d1-8493-450eee749f3e", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644347722, "uuid": "cea045d5-1260-4f28-b56d-3f8067543ca6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347722, "uuid": "03e6ccfe-9594-4ff4-99d6-a9727e87b41d", "value": "tmp7vehqigx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ebb5140-887c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644282936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282936, "uuid": "c82a52f2-0c06-46dc-8b22-ace3ebba5dd4", "comment": "Malware payload (Formbook)", "value": "a616d7f0cc6a4d07ea1f2641303d1e9b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282936, "uuid": "84120075-95a7-4ba9-90e2-5ad1902fcda0", "comment": "Malware payload (Formbook)", "value": "2bd307fdfdcf9b621f6b579cea53f374f0df6085cc21a6320913e1bdc2661792", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282936, "uuid": "e7dc6bf3-1083-46ef-9176-e683f3913955", "comment": "Malware payload (Formbook)", "value": "e80c917abbf7f2998f150fc4ff998eef23034634", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282936, "uuid": "e7a4e4c3-6db8-4f88-b770-d26f78f8810c", "comment": "Malware payload (Formbook)", "value": "3ad5378de7a49db2818693b623b61e78b76045ae17fe51c0b91fb20d70af37b90f90bc974577d01d3b9f01eb9ff8c99d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282936, "uuid": "7d839ff8-241f-4042-a2bf-e051d5d42b5b", "value": "T1061402216640554FC98AF7361B3952AC4F25EDCF9E3A1A0B7505B264843AC2876EFE33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282936, "uuid": "dec81348-324d-4f50-81ec-6a9409d3017e", "value": "3072:XtXGUyVwu8T07M19s3iowTz/2eOcAMbVl3RzY6iiSyz08yfj/0VduTuMoz8ODB:AhVRG2M19scP/LO8bV1RUaSyzgb/XuMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644282936, "uuid": "3863e64c-6326-4065-8d3b-842f4d8fdb87", "value": 191944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644282936, "uuid": "ae3221b8-4a55-4c8e-9f9f-59065f259bde", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282936, "uuid": "f79b7e3c-7eb6-48b1-9c1e-c4ce37258a21", "value": "ORDER PACKAGE - BALTIC GRIFFIN POLAND.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2f334e-8912-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644347173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347173, "uuid": "262dbe15-6d0d-4c34-aed3-5b6963d826ad", "comment": "Malware payload (Heodo)", "value": "039f643e83206b9d5320464a3f369bf4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347173, "uuid": "774ebd56-8253-4890-9546-a4f88dfe8ab7", "comment": "Malware payload (Heodo)", "value": "2bf6f15c3bccc3d0295b72d230c75f706398d4a23bbbd482c4526cf7fe54ee22", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347173, "uuid": "ec55478f-084b-4b97-86ed-9d7c35272986", "comment": "Malware payload (Heodo)", "value": "28f658d63d054a02e2019c18e2c3f3538e5cedf1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347173, "uuid": "ef8ad2d1-c3c8-4200-9b78-003a028d29c5", "comment": "Malware payload (Heodo)", "value": "753eb00acb9c3d1a59af82bf483956cd7701d5500d7a909f2e3435e411e8c119ebc6fb3e20939285274582846b87896c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347173, "uuid": "be3c2dbb-5f92-4c93-8e26-c7e5d00d8b1f", "value": "T1A2748C41E952C03CFEFB00B9D0D6C62AAD1E2E211B9D569F6245366D36603CF163F62E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347173, "uuid": "2cf70d29-edd3-4cae-b1c6-8f5375a99bb7", "value": "79fb40281049052b3e354a6e444da473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347173, "uuid": "0909c44f-1a53-41f3-ae0a-b7ede406d39c", "value": "6144:YFF10hIGpvaeY+wBuBqtrgummwYT4ahREWkOieUR6:yKIG5fEnmGcKS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644347173, "uuid": "1d944ad4-1169-45b1-88e7-2ec516b7dde0", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644347173, "uuid": "612783ba-708b-4319-9b39-9c2370153480", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347173, "uuid": "f692d643-b801-48a3-a972-208ed1691973", "value": "emotet_exe_e5_2bf6f15c3bccc3d0295b72d230c75f706398d4a23bbbd482c4526cf7fe54ee22_2022-02-08__190603.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eac24d2-88ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644330100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330100, "uuid": "78a6aeaa-4a8d-4f95-9003-09d7342ca376", "comment": "Malware payload (Heodo)", "value": "e06c9cfc8d05d00a1b2d697c666b2a4b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330100, "uuid": "8e13824f-ea8d-4aff-9694-589b803db531", "comment": "Malware payload (Heodo)", "value": "2c01d8c38144d351914ca6c669762de663da128b6339fe84a22872b46ceed98f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330100, "uuid": "73dbf9cb-055f-43b7-b92b-f095bc0ddb51", "comment": "Malware payload (Heodo)", "value": "6a52abfc5a1929bc072579581bffe6bb39221374", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330100, "uuid": "cf205385-cea8-4bdc-882e-caf7f393993b", "comment": "Malware payload (Heodo)", "value": "6d7575843c899c91a71b74c53d8b27386ed492f687e6238c10c96e5c285460bb300ab883f42229bf721038fb491fdc5f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330100, "uuid": "e73279f9-0b68-481f-bc73-04eb67e1bbeb", "value": "T173848D06E652C03CFEFB04B8D496CA66ED5E3A24169D619F63413A6D32613CF123F52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330100, "uuid": "7baf380f-9e47-4d3d-8c9a-01839dc3b23e", "value": "79fb40281049052b3e354a6e444da473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330100, "uuid": "c7131723-f0a7-424b-835f-de03f996ac34", "value": "6144:O56dLjBFLyztOoWeYIjAmkB8lebi9JqGXdZ32mneM0laNUIbeURK46:YszuzN9jWB8f9JqQ2mnB0l4UMK46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644330100, "uuid": "98b6447a-f862-423e-b7f6-145e4726ef50", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644330100, "uuid": "efdd379f-aa78-4c8a-8af3-c0ba4dec8e1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330100, "uuid": "f63b5fe2-ec25-44be-82e5-6e36c16031dc", "value": "emotet_exe_e4_2c01d8c38144d351914ca6c669762de663da128b6339fe84a22872b46ceed98f_2022-02-08__142126.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e7be8e-8887-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644287429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644287429, "uuid": "b175b1f7-c7fc-4e0c-81d8-8fb1f912dc07", "comment": "Malware payload (Heodo)", "value": "b4370e22ade60af17b3743ffb6a6f33a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644287429, "uuid": "5f217a35-312e-4611-916e-4fdf096f83f2", "comment": "Malware payload (Heodo)", "value": "2c64c7aa079c17dfd383553b9a6e1a29442622168601ecba8e8ceef3971d635f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644287429, "uuid": "d7e36741-8304-4b34-a9e2-425abf18174f", "comment": "Malware payload (Heodo)", "value": "b734689de212880dfb8c79f8139ddf3bc474c299", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644287429, "uuid": "6078b5a3-5273-4e30-9632-0a419376f9d8", "comment": "Malware payload (Heodo)", "value": "cd50a08e7ac89885b1e11c1123bc782e1193c8bea28c0fa406b463881d97d2864355a5f67d5154012baf1799bf310e77", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644287429, "uuid": "12d92857-ac93-40b3-ad7e-7cd325e5d061", "value": "T16593F15E3E1C7E0BE1CBE238DF38E96452255CD07292B8796060BEBA513D493C16AF5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644287429, "uuid": "726203ea-7ae8-4bb8-ad62-c1fa608d94f8", "value": "1536:zZRoqIoLfJJqP8lSMSKa3Xm1WBXz7yL64i+kkfa+3gtfvjHtoxzg5bjIFc+e:zvoqZLnqPKa3Xm4nC5X5gxvhoxzMIHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644287429, "uuid": "577a789b-447c-4a9d-b4a7-0640b92ea1cc", "value": 94225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644287429, "uuid": "c6bd795b-f30a-4b06-8961-9ba13180726a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644287429, "uuid": "a3b51eaf-4634-4bdf-a9af-0cbfced844cc", "value": "tmp_hiilafq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc47931-88fb-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1644337591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644337591, "uuid": "16962980-8b23-4794-9a72-cee3dfce3676", "comment": "Malware payload (AZORult)", "value": "d163e4d75e3e115cce99679d08595c6e", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644337591, "uuid": "a3e8ae42-970f-44d4-b31c-a06888a185f2", "comment": "Malware payload (AZORult)", "value": "2cb326bf23a15dfa548df0266743efffefe1cb91450b3146e03e72f51c2cf0d9", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644337591, "uuid": "4070da33-50ae-4506-8f0c-b45314b24ee8", "comment": "Malware payload (AZORult)", "value": "a859952a86158d2f60ed927a966d17eede94887d", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644337591, "uuid": "116daf72-ccc5-4c17-b40d-e4e0012ddd8f", "comment": "Malware payload (AZORult)", "value": "ea85c4938f93dfdb206f8654d1e18b637472fe3bbf1302154fced7fd1fa1613bf3a47480d82114b4e83e363113a3966a", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644337591, "uuid": "743cd763-c80d-4521-9646-6dc50a90a70b", "value": "T1C435F1567941A4F2D04E35B9E6A2B1D04629FC3626E30297F34C3E1AFF73985DD26322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644337591, "uuid": "eafb3e74-a057-4add-a0f7-f0f6f7967af9", "value": "b985816070bef8efebdfdcd91627363a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644337591, "uuid": "76e40fe7-a2dc-468b-b065-36b9baa329dc", "value": "12288:/9odY9SCVijMRXOtQt09oz4FMGH9uct73wNIX0809wFPXtQA:n9bVijMRXOttoz4FM0oeDAa080uT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644337591, "uuid": "951fa5fc-639f-480b-b5cb-56123add6d7d", "value": 1130496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644337591, "uuid": "132166bd-3c00-46ad-9e6b-b4afb5508e7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644337591, "uuid": "d7612ef2-f881-4670-8ed8-257c3a7f36f1", "value": "2CB326BF23A15DFA548DF0266743EFFFEFE1CB91450B3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e89f16b-8912-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644347172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347172, "uuid": "ac41fc26-a17e-4ef7-8cb7-f314e7fe944d", "comment": "Malware payload (Heodo)", "value": "d35dd2822ac549dee57820b389697527", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347172, "uuid": "a2423865-dba9-4423-ac20-762162e8eab6", "comment": "Malware payload (Heodo)", "value": "2ce2876beb5b35d29505c6b636880ad77f1e7c769bfd9906c623e19bd5e07f6f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347172, "uuid": "29eb97b6-2315-4796-a687-2cb455210a6f", "comment": "Malware payload (Heodo)", "value": "95e4122784d932f31692fa81b9fbe3157e9d7ae4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347172, "uuid": "a27c26c3-e941-4abc-9181-b54d4234ebb3", "comment": "Malware payload (Heodo)", "value": "eb7afc4cd14bcdb8bb3a2b012a8401c6d88f559db8d182e670edb1fe0716a077c1533c90c980f295fcd15a08b3687ef7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347172, "uuid": "3ba6a4b4-8ea2-47de-b7f4-9df08469502f", "value": "T112748C41E952C03CFEFB00B9D4D6C62AAD1E2E211B9D569F6244366D36603CF163F62E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347172, "uuid": "23172d9b-8587-4620-9af5-62859b8e6c87", "value": "79fb40281049052b3e354a6e444da473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347172, "uuid": "dfabe6e7-e114-4077-b6b2-2753dbe4ea41", "value": "6144:YFF10hIGpvWeY+wBuBqtrgummwYT4ahREWkOieUR6:yKIG5rEnmGcKS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644347172, "uuid": "7de2e76a-3e6c-43fa-a0a0-1f622fe3d5d5", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644347172, "uuid": "c3ebdceb-de46-4702-a6fc-fb9505e6540e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347172, "uuid": "6064fab8-d7f4-47cb-b56a-55a10b799993", "value": "emotet_exe_e5_2ce2876beb5b35d29505c6b636880ad77f1e7c769bfd9906c623e19bd5e07f6f_2022-02-08__190601.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd599870-8923-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644354740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354740, "uuid": "1f3a495a-9bc5-4128-88e3-97788e77a5f4", "comment": "Malware payload (Heodo)", "value": "ab9f9b90c288ea51f6085a66b7e8b0aa", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354740, "uuid": "bc5915e7-ac19-4602-83d5-828ea1627df8", "comment": "Malware payload (Heodo)", "value": "2cf48a6efa4e30ad27034f0bb61458dd9ad7b175e279794a7bd8d6f7cd3a9b6f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354740, "uuid": "ea8fdad0-b3fa-44d1-9f70-389575f6432a", "comment": "Malware payload (Heodo)", "value": "1b7f6651df3abf37bc077a14e70ca85faad04c8c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354740, "uuid": "c4f5886d-5040-47bb-96c8-f419f63a715f", "comment": "Malware payload (Heodo)", "value": "c9b1d7aea88c831e94f7f8e6cafc186667fac911a52d8380523bea2ebbc8b12149f7bcdbad3b3ea94d5e764f33109e9b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644354740, "uuid": "0a4e89ba-85c5-427a-abea-b7a0b3dc316b", "value": "T1E3C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644354740, "uuid": "c42197c2-1b52-48f3-8a7b-699bec3789ad", "value": "3072:LQcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfB2:UcKoSsxzNDZLDZjlbR868O8KlVH37kee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644354740, "uuid": "653354a2-65e8-4210-8a8c-62a21b91e489", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644354740, "uuid": "02b8673d-68c3-4602-8eef-2e795cc3a22b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644354740, "uuid": "dfd5eb39-bb55-45b1-b672-d10e1ddd8b70", "value": "tmpyh1qjhvc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210b5bd7-8898-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644294751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294751, "uuid": "f4b2585f-7fd2-418e-b4ba-1a1e8728cbeb", "comment": "Malware payload (Heodo)", "value": "b6f0c82307fb180fb113b39739195e31", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294751, "uuid": "267f0ab4-b77e-4bc0-af9e-d3a5983745b7", "comment": "Malware payload (Heodo)", "value": "2d0050e51893ec06bc67ea8fdbe304f836b3a80448cda4487b19334e54384247", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294751, "uuid": "a1f354e5-479a-4f5f-963f-1d41f7cba8cf", "comment": "Malware payload (Heodo)", "value": "9b81b67b9c5f6a97c3b1639c5e688beeeeab4c84", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294751, "uuid": "dd7219e6-a2b5-407b-8902-14d8c7d6c0ae", "comment": "Malware payload (Heodo)", "value": "ce55fe5b6379abfbe5ab9c18b5c286d870ab679928eb2949214f9d2b1c3c7318876864aeca65dab1e5106f7755c94a45", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294751, "uuid": "55bcf620-c0de-4b66-b344-8762fb7df386", "value": "T15CD38D6ABA48CA0BD94953314EE7CBF67336BC819F5297473295B72F1C3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294751, "uuid": "a9e503b0-5e2a-4ade-885b-c8768987329c", "value": "3072:JcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3Q:JcKoSsxzNDZLDZjlbR868O8KlVH3skep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644294751, "uuid": "7651f5d0-412e-4f27-9ba3-a21cfae3efe4", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644294751, "uuid": "a4acc160-6cc3-46d2-97c3-60c41a011365", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294751, "uuid": "c8f8b91e-1193-4052-a0f5-b4bb3efc8d52", "value": "tmpt9_tljp3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b8371f5-88fd-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644338147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338147, "uuid": "b23aba30-4d91-468a-9443-e2894ded7ffa", "comment": "Malware payload (AgentTesla)", "value": "4b9898dc2770ef38111e23cfd50bc210", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r17", "colour": "#506530", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338147, "uuid": "a154399b-48e0-4d0c-a5b3-2a7a0e1118e9", "comment": "Malware payload (AgentTesla)", "value": "2d006d53fa034eb4fc84314bcfaac158060c99a6b8254231bc4d6595be8239b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r17", "colour": "#506530", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338147, "uuid": "89548d0a-d0e4-4a29-8ab9-f8591ac83d02", "comment": "Malware payload (AgentTesla)", "value": "d8f0196a9ec40c5b05e55f6c9469f86d2ede4600", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r17", "colour": "#506530", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338147, "uuid": "6dd62a6a-fbd5-4b5c-ae67-0a91452325d8", "comment": "Malware payload (AgentTesla)", "value": "14c9fb603bc60399e3cc055ed054fa4f3e9f1a3f2e8f460dbbb050fab8b9bfff0b70b0f0a420769a5903aecd82ecb6e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r17", "colour": "#506530", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338147, "uuid": "a8f0d050-803d-4638-aab9-995bbbdf720b", "value": "T1D1A4239E0A80A78D4C0B50FFB3A19F05CDEB21A8BFD44AC87D3D60266068DF13E57658", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338147, "uuid": "7aa7dd9b-874e-45e9-87a2-58a61168ebd7", "value": "12288:ps5R4dh14sJjVXi+I03PglcWlnyp3yXU/9SYL3S4:MR4Jri+LgeWlny1yX4jS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644338147, "uuid": "f626f61d-0a8b-4287-a587-fd6310f5ea13", "value": 454466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644338147, "uuid": "613c756c-ebc4-4142-b4e5-b06f88986eb5", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338147, "uuid": "7a3b63aa-e446-4e00-9002-ae5c8dd67508", "value": "INVOICE #7833.r17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd7cacc-88b3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644306640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306640, "uuid": "b28005fb-d895-4e7f-a29e-55e7def65be9", "comment": "Malware payload (Heodo)", "value": "1257a369ee336f5051f0fc8fc16699c2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306640, "uuid": "866fb8d3-a235-4efd-b3a5-d991afac97ca", "comment": "Malware payload (Heodo)", "value": "2d02c13e702ae5d8c9fc3248059c59a6380551a7e5616a9d3c14b079454f850c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306640, "uuid": "ddf12d6b-30ec-455a-bcc5-633fd154d531", "comment": "Malware payload (Heodo)", "value": "0c70af5d583f1840ba1785bc7dd77ca524d07aab", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306640, "uuid": "12a73145-86e4-4522-b2ab-9024cf0a2e9c", "comment": "Malware payload (Heodo)", "value": "54ace1d671c0d596cf77653a9851723ac432f1fa944d2dc625a2d3b290e5a2f3300a6a6fd5217efe0caf1fcacc699452", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644306640, "uuid": "9b6b252a-1cef-4df7-8c25-d2bba2dee568", "value": "T1D393499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644306640, "uuid": "9dc898d1-8691-488e-9b7d-ef6d3b3eb9ea", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644306640, "uuid": "851e2e19-9ea1-4b9f-a284-fb5a6e0914a1", "value": 96587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644306640, "uuid": "0ee838b3-71db-4836-8ff1-22b899ade9ad", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644306640, "uuid": "bf568a9b-ad74-4540-81cf-49a8711f9cd0", "value": "tmphgccotlk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "181ca10e-8918-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644349711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349711, "uuid": "e209f1d3-02e6-4bd3-aa0f-3945457eab1c", "comment": "Malware payload (Heodo)", "value": "e6190d7d09a58e7e3560bc6bce70838d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349711, "uuid": "95c36012-2af2-434c-ab78-b0284d818457", "comment": "Malware payload (Heodo)", "value": "2d0fb763e4ce797a0c9549b2128de8eaab0258f8de86494999c2686038477f49", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349711, "uuid": "512fea41-53e5-4392-98d8-0db72b474acd", "comment": "Malware payload (Heodo)", "value": "e1d531d5a23dc8e91581332ade4a7b300f881a27", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349711, "uuid": "c8f48387-4984-46ba-993c-d23c6eedf685", "comment": "Malware payload (Heodo)", "value": "66a9ce0735bf405ce4044534f661344ac173f67dafec4445cf734f7a6aaa5d5ded9ac496a9170f734a94e29984a46743", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349711, "uuid": "7c13908b-e543-480c-b7de-098ac2cbb8bd", "value": "T17EC35A55F685EA1ADE0822350DDFC7F97336BC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349711, "uuid": "57856df0-f6f3-469f-ba3a-976a072c396d", "value": "3072:aOcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfB8:DcKoSsxzNDZLDZjlbR868O8KlVH37keE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644349711, "uuid": "2c30a252-0bb6-4258-8cae-3b633b93c8ba", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644349711, "uuid": "61a38484-b360-4d44-ab05-b03b1521ce5a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349711, "uuid": "e464d58c-3037-4530-8ccd-07403e5a613c", "value": "tmp_9ry266w", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4b8fba-88ce-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1644318236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644318236, "uuid": "1796f498-de23-44aa-adb5-8ae7fabb0d06", "comment": "Malware payload (RaccoonStealer)", "value": "efafb22b77472db4d047e0f89dc4e6f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644318236, "uuid": "128051c7-163e-4a2f-98ac-a2831bb3130b", "comment": "Malware payload (RaccoonStealer)", "value": "2d2a03a2eb59a64eef9f15d160a2919707c5dee2844144d8ec9fdaae724a4162", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644318236, "uuid": "454d5612-8838-4eb9-b3bf-387cbcf5ca25", "comment": "Malware payload (RaccoonStealer)", "value": "1a674f9a9cc9cf7aaa4b19c8ae389a63d2a37e3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644318236, "uuid": "315d771e-67f2-488a-be13-087c58cdcd21", "comment": "Malware payload (RaccoonStealer)", "value": "75cc9d829a3ebd0f4d73d43c00bed1b5b3e59a2b1b6f77ff6fd5aea6743879876307cac3e8f2ea13222fe432352d1803", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644318236, "uuid": "b8cedce3-5d8e-43ab-a672-86aa41be66c6", "value": "T176B4E010BB90C036F1B716F4457A936CB52F7AB26B2465CF63D526EA1A386E0DC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644318236, "uuid": "e344da38-a752-46f9-b68b-11e0b261f419", "value": "63f9a18a26e146489d4459889103d05c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644318236, "uuid": "e9e8817b-d98c-4677-b724-fefe08634bb0", "value": "12288:arDiNiz+rx5XBXudOm4bcgpi/ZtM8vcXQ7KCTD53fNm8Lb0uEQxe:4p+x5XZukm4bc/7VEXAvtNxb0u1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644318236, "uuid": "1f0c9504-bdc6-46c8-b92f-f632a246dbea", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644318236, "uuid": "809a6306-6166-4334-aa69-4a6e1f1fd0c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644318236, "uuid": "b85b89da-be3e-42c4-b6ad-8536b6104104", "value": "efafb22b77472db4d047e0f89dc4e6f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486376c6-88cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644318439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644318439, "uuid": "d2ca21cd-86a1-4a78-9f27-7704bb8373c2", "comment": "Malware payload (Heodo)", "value": "6b80dd8fb5551c52ccde103678596863", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644318439, "uuid": "e797bea3-095a-4476-b503-279a1994a000", "comment": "Malware payload (Heodo)", "value": "2d2e685cb3ae7c082682710e1fde1b78da72fcbd18ffe3cf4dcd15f7c628356a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644318439, "uuid": "3cf3f075-bf1c-468d-b04f-bb84fcebecff", "comment": "Malware payload (Heodo)", "value": "80b564a3ad4717f815021f06e7b9f30fd91ffae8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644318439, "uuid": "f72ac1cb-4074-4a0b-af85-c714516f161b", "comment": "Malware payload (Heodo)", "value": "fc665d410753b8f789ddcd0df783928939c9e245870add0e082025ed1de41ea33c954dbfc8dfabd08b82ec21d1b4aa75", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644318439, "uuid": "79089f11-fbf3-4df0-b6cb-8ae260370eb2", "value": "T1EC93499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644318439, "uuid": "be0a9663-7230-4f4a-a1ce-38dcd128a248", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644318439, "uuid": "8d193436-bc4a-49da-adc5-87ed3ec312bb", "value": 96902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644318439, "uuid": "bfdfba8c-390e-4a42-8190-27a9d7607c2b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644318439, "uuid": "f964cf4d-8390-4218-8ff0-cf920306a0ba", "value": "tmp6dqllu8r", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919cd309-8872-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644278619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644278619, "uuid": "69d92e3f-5a17-4461-b697-8f5927346acd", "comment": "Malware payload (Heodo)", "value": "1daafeed2a56b39ef1586f025101a050", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644278619, "uuid": "5377bc09-be5a-4bec-ac83-f927007871de", "comment": "Malware payload (Heodo)", "value": "2d2fe76e7fe26ce7ea2a2bdd03c850a1c43fd0e3ebf58032b69b4c28ca638a0c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644278619, "uuid": "d787bee5-635e-4294-809c-0450f6400aba", "comment": "Malware payload (Heodo)", "value": "b9b8a0c0ebaca1ac372b489f8fd5d5a3f1256aaa", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644278619, "uuid": "319c2eed-ebb4-4136-b193-cfbcd39ec255", "comment": "Malware payload (Heodo)", "value": "fd99d002df31e4c70a0617a4d1b0254a1f6e43b597acd6310f3d75cb660b6bd1af7006596f5d193d66906f137550cad0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644278619, "uuid": "b12784ad-7e60-4dd2-afcb-13abb7999a53", "value": "T15C93E16E6E1C5A07E1CFE138CF2CDE6082545CE072A2F4FA64A16F7D403D453C5AAE68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644278619, "uuid": "fbf8b8df-1d4b-4e06-8b47-b3120d9762b7", "value": "1536:zZRESsGMwzuEQKX9mwtqgCvw0RSKa3Xm1WBXz7yL64i+kkfa+3gtfvjHtoxzg5bw:zvbsmztR9m+PCha3Xm4nC5X5gxvhoxzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644278619, "uuid": "c179ad5e-50a4-4994-873f-eb1d74fd345c", "value": 94226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644278619, "uuid": "f63edfff-7414-4507-a580-a00e2b7579c0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644278619, "uuid": "6735c794-43ee-4889-835c-a96f45ed558d", "value": "tmpugtpgi85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1484e239-8902-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644340256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340256, "uuid": "4a21f412-2d13-4471-bb9b-f880e097db0e", "comment": "Malware payload (SnakeKeylogger)", "value": "de7d8e24c3a12adddaea30870d48181a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340256, "uuid": "92db2e3f-eae5-40a3-a214-751858d5d1ca", "comment": "Malware payload (SnakeKeylogger)", "value": "2d535e1a78a7673d42500b204b083114df887155bc7468ece3b4bf84aa2b5e1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340256, "uuid": "4baadd8b-f681-4f4c-97cc-1c4b3707e8e7", "comment": "Malware payload (SnakeKeylogger)", "value": "9f99e5e0f03d6fae5a44aa4213394b6a7233eda8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340256, "uuid": "bb4f6e13-4427-41bd-9b67-426941f1ea48", "comment": "Malware payload (SnakeKeylogger)", "value": "f7694f85848bcd27963b1cdfa83fbb2bc3120a59bbfa22cc87d8e93e950375fcd9b176bce881db79e5e6ba491701fcfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340256, "uuid": "14f3abd6-d405-4d1b-9072-ac92e328f61d", "value": "T1A0A4593F49BE213AC6FCCB709880CE1FF426D5963977691D269626D905232F275C222F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340256, "uuid": "3e081208-dfed-4b71-ae76-1249c884f068", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340256, "uuid": "a1f9d65d-ea48-45df-9be6-b04ff2174f4e", "value": "6144:qieDsvAJPiPwJDTTw5XrqNd+PiBjEQR2L56aSmDOPoDLGUzrA:qieDMAsyfc5cd0iNk52y9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644340256, "uuid": "f2aad3dc-7ea9-4949-841b-dfa8e3e5970f", "value": 479232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644340256, "uuid": "f60bfee1-7706-4909-b116-a27abfa882ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340256, "uuid": "20e6dbe5-f461-4263-9994-93ecc99491af", "value": "\u0130hracat Vesaik Sevk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2936f0-8915-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644348594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348594, "uuid": "cb1a46f3-4dec-4b90-83ae-ec9639b1b0e7", "comment": "Malware payload (Heodo)", "value": "b55dad30e99b655fa28b02d8db5c7873", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348594, "uuid": "ad33df55-0a09-4430-8a4c-30788c8f4357", "comment": "Malware payload (Heodo)", "value": "2d6140843753bf80ed4c3f6839d44ffdfeab7ca7f124871e266333eb945f63cc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348594, "uuid": "ec4fad6e-0fe8-4e8b-884c-2819d61b419c", "comment": "Malware payload (Heodo)", "value": "193a48b95aaaf9b8d4565907c4ef38b09cf9b628", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348594, "uuid": "9817dbdd-a215-43d0-b47e-761852822a06", "comment": "Malware payload (Heodo)", "value": "921f1bce0150bdc8545849554e64044110cfb5c621a539c5800a0283fa7c26ee3951df267f2f6300bc5756c7a89b31a8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644348594, "uuid": "9a62ac5d-c7b9-4176-a5cd-97f7c3c387c1", "value": "T1DDC35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644348594, "uuid": "6fac7f30-178f-4807-9659-9c0a84bcd5a9", "value": "3072:pucKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBX:8cKoSsxzNDZLDZjlbR868O8KlVH37keL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644348594, "uuid": "0fb73ede-bc5e-4d73-9173-ec7e3cc97f83", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644348594, "uuid": "edcfc5c4-d7a7-4869-b805-5583c175709d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644348594, "uuid": "363cd623-4ece-4788-8df9-403afc19f804", "value": "tmpm_8fe1wn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e6f03e-8913-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644347592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347592, "uuid": "bb4bf369-24de-4896-9b2e-258f76857412", "comment": "Malware payload (Heodo)", "value": "89af772001f883d44e7a6d64516e9b47", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347592, "uuid": "1cef2da7-8d55-4659-b1ec-772ad59c4b41", "comment": "Malware payload (Heodo)", "value": "2d777800651526c1ab8c98d4ead43483f4f057b35292222c4802fcfd4ca8a667", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347592, "uuid": "c5c111a5-cfc7-4e11-8796-09b90bd9ea3e", "comment": "Malware payload (Heodo)", "value": "aba813a2321405c8dd748f2422057b8121d2200b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347592, "uuid": "31e83aab-3631-47a1-b483-c77ae99d2011", "comment": "Malware payload (Heodo)", "value": "1ee3ecb3ec3295e86fa786fcc1f0670a84ceda8171d85e9cd5f961a438f4b0695aebc2bc017f3bf38f38f7d1bf11631d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347592, "uuid": "91add38f-9bd5-4f34-8594-af3b388238b3", "value": "T100C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347592, "uuid": "28023a68-9516-481f-8d30-a277aaa1fb3b", "value": "3072:/lcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLB1:dcKoSsxzNDZLDZjlbR868O8KlVH37ke5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644347592, "uuid": "1dd05692-f126-4c80-bd59-ea29b6465c17", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644347592, "uuid": "fd7c5ae1-960e-496d-998b-5201fb68c7c6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347592, "uuid": "6f56be10-85d8-4a78-9a76-05f1ab079ec3", "value": "tmpv278yihm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c98f522-8917-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644349316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349316, "uuid": "7d14f523-e9d6-4ac6-9191-d6403cea48c0", "comment": "Malware payload (Heodo)", "value": "67deb84d29265d2037c625a4f0d1efbe", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349316, "uuid": "88a882b7-29a7-422a-931c-85057fb78d45", "comment": "Malware payload (Heodo)", "value": "2dc0d1fc990bfa979ab5efbf88a0d189cf2b9dacbfebaffcaa2af97a781da898", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349316, "uuid": "a8764f42-6d47-4223-a786-ad8cb07a06e5", "comment": "Malware payload (Heodo)", "value": "554fe9db22fe372de028cc66dc4f8669e133a129", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349316, "uuid": "7a442503-c68f-4a84-99e7-9204bcdf124f", "comment": "Malware payload (Heodo)", "value": "264a111510c89916487c0ba1366b6258321408a1f2a8ccf72d28110208152f94049031c922949fe94f30bd03b87c3111", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349316, "uuid": "aefc4b78-bea9-4ced-9d54-4ff716631d8b", "value": "T10EC35A55F685EA1ADE0823350DDFC7F9733ABC828E9683473289B32F7D76550CA12606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349316, "uuid": "fca72966-ce03-47a9-b81e-facde345253a", "value": "3072:PkcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBO:McKoSsxzNDZLDZjlbR868O8KlVH37keG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644349316, "uuid": "38c0dc59-7e80-430f-8933-d0df3c91df1e", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644349316, "uuid": "30cfd74b-edaa-4885-892e-38a91db25980", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349316, "uuid": "a3b8ec1e-4057-4b2b-a225-10dbce0957c7", "value": "tmpelvkx_wb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7b79fb-8904-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644341375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341375, "uuid": "98197076-fd01-4bf9-bbcf-62c7166b52d7", "comment": "Malware payload (Heodo)", "value": "1ac13085b62a1c1e2018eb8b520a2601", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341375, "uuid": "396c89b7-808e-482f-8608-63158a031ee3", "comment": "Malware payload (Heodo)", "value": "2dced10069ecb2c3d85322685c9cb85f1c4e65833c2fa1bc65212abf47925b57", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341375, "uuid": "e93b3948-a751-46a3-8997-83e741842061", "comment": "Malware payload (Heodo)", "value": "52e7d9841576377d6d7d9a9be92ae9b7bfd24553", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341375, "uuid": "339705e9-2c19-40e3-817f-bd8aa8f22ad0", "comment": "Malware payload (Heodo)", "value": "bff5d7d333237edab249e3b2bc6576e03f54fab370a0d2895357fbd663f4eee449cc1fe36c7debaa44ee7d8306394f9a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341375, "uuid": "1df907aa-520d-4323-83fd-798dd3a9cf40", "value": "T178C35A55F685EA1ADE0822350DDFC7F9333ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341375, "uuid": "847d5c71-cbf3-4be4-abf1-d8b8b720e3c5", "value": "3072:4KcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBG:5cKoSsxzNDZLDZjlbR868O8KlVH37keS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644341375, "uuid": "87ca1ccf-ac07-4390-9df9-6e56cc7d453b", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644341375, "uuid": "72d5fd08-acac-4f41-b2a6-04d221f6987d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341375, "uuid": "f6704279-0aa8-498c-8518-45cddbdb6b93", "value": "tmpef9ubzd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264ee855-8922-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644354030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354030, "uuid": "339a25b5-88e4-40ea-8549-aaf3b5a80bb4", "comment": "Malware payload (Heodo)", "value": "6a5bbb7a93013c152cb71194ff8c472c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354030, "uuid": "efdcde16-bd24-457e-82f8-39455c94ea89", "comment": "Malware payload (Heodo)", "value": "2ddbb8d2d7fec9d85558b5bd751608b4cc1f0d2b379e410dc173473120d0f2ce", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354030, "uuid": "8d16b049-a476-449c-be2f-db66d643b50e", "comment": "Malware payload (Heodo)", "value": "f3f2184637c9d2d9d16483f44fe8916f9e4afe35", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354030, "uuid": "7b0d5675-2e9a-448e-99f1-b071ee2eb9c8", "comment": "Malware payload (Heodo)", "value": "41ba71ec3c4a4a7b1d7e48e21dd8ca025a990f5092936689beda6cd363f4bb92348624a8143a0fdaf6840c18f9db3bf5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644354030, "uuid": "b6084b71-99c7-4431-8a39-433bc5b950cc", "value": "T1F4C35A55F685EA5ADE0822350DDFC7F9333ABC828E9683473299B32F7C76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644354030, "uuid": "73eb2944-2cd0-4ca3-9dc4-c4424bf09972", "value": "3072:4ncKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBE:IcKoSsxzNDZLDZjlbR868O8KlVH37ke8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644354030, "uuid": "ed19f35b-279f-4268-be51-322a21464043", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644354030, "uuid": "219c2cc9-da5b-4d99-8dfa-a17fe8597f4e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644354030, "uuid": "6509f590-3097-4280-8b4b-b43ae35b52e9", "value": "tmpfb65mm_j", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e467baa-8895-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644293431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644293431, "uuid": "d14da910-1aee-4041-8b4b-30752dfcbb3b", "comment": "Malware payload (Heodo)", "value": "d8c4dfd80aaec3f8f8428a525b71b3c8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644293431, "uuid": "869cef94-4505-45b9-9734-7fbf38c52f25", "comment": "Malware payload (Heodo)", "value": "2e23d56536654582dc321b13b61e60dea6b46889e115ec5d94417bb90ba1f159", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644293431, "uuid": "500a1815-2450-4fb4-9009-0e4e3d982f2e", "comment": "Malware payload (Heodo)", "value": "df74748b522f713982a7cf0258a9c96b803b362e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644293431, "uuid": "3a010d1a-2100-4aef-bd20-1eea6320e555", "comment": "Malware payload (Heodo)", "value": "bad7c798c71bac3aa64930eb3d3e0b42b599e18d76f9b107db7c6c307c0152ee246311354071f74f59037f2be848413d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644293431, "uuid": "4580ce46-c7cf-4a23-8a12-3436e7369447", "value": "T177D38D6ABA48CA0BD94953314EE7CBF67336BC819F5297473295B72F1C3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644293431, "uuid": "61e2bbac-7d04-46e6-bd74-07b8355012b0", "value": "3072:tcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa36:tcKoSsxzNDZLDZjlbR868O8KlVH3sker", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644293431, "uuid": "ea31e467-96a2-43cb-9751-6d87b07f09be", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644293431, "uuid": "1e512e84-0dcf-4360-ba02-5392bab0ed99", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644293431, "uuid": "35dba5a5-d675-4cce-94b8-3b29a66d8d3a", "value": "tmp98xftfhw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92dbe8e2-887a-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644282057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282057, "uuid": "8b9c71e5-1fa3-47be-a46e-96fa88618f11", "comment": "Malware payload (Loki)", "value": "c82bbdca4da54ac6b2c6a19143869372", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282057, "uuid": "3049d638-7715-415a-a8e5-7273b710acf0", "comment": "Malware payload (Loki)", "value": "2e49fbb3cc2392ae127f91587a2a08de041092f2e718a2b47ba3737ed8086b3d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282057, "uuid": "1803edad-03d7-4666-b3e3-44c6648940cb", "comment": "Malware payload (Loki)", "value": "9bb878d855a5a0d1437e15ba751661f091545a4e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282057, "uuid": "06d2593d-50da-48e2-b13f-25e08c368fa8", "comment": "Malware payload (Loki)", "value": "2a8a7d61fe7e45f99dd28d55c6b7db3d599d64d3204702c0f0280e46e13835cae15072422f1e4b41d71777c674404eb4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282057, "uuid": "45d843a2-2149-4ed8-bb88-e4c9eba4bf13", "value": "T1C512082C62A509DDCF8E61B0AA36F90950DE7D6A93DAD59376BC37501B1233D6B0B404", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282057, "uuid": "9411f641-4c66-4051-a582-ffabcc8b3291", "value": "192:xkmVVhNUqhq59FQHoYNk+CJp+jpJH2mS+JV79j0c2RKnNanklMCk0Pjg:ygqX54pk+CJ4DHP9wnR9nzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644282057, "uuid": "b6e1a3a1-9ec4-435e-9fa9-3e4b81a168b9", "value": 9356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644282057, "uuid": "c920d977-a7eb-4a8b-8034-6d61c17fd74b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282057, "uuid": "196412d4-dfc2-4ffa-a402-19ff8aad81db", "value": "scan 2022-36S.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e8385df-8912-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644347172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347172, "uuid": "e3524060-7ba9-4428-9f05-7e3f078137d8", "comment": "Malware payload (Heodo)", "value": "2e26696e2d61a521473ca1aee2b87c0d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347172, "uuid": "98e78834-2e17-4d62-8b85-9ab82b068340", "comment": "Malware payload (Heodo)", "value": "2e5351d34f57efd766a17be45876e6c5fd1eb0f3f20cab75192696348d6a094b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347172, "uuid": "7861f412-d9b1-42be-99f9-1fdaa0e69ef3", "comment": "Malware payload (Heodo)", "value": "cb8c9f6baf04c31072816c63c477690fd91a8479", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347172, "uuid": "64314660-3dd2-4d10-8f4c-983238c41ec3", "comment": "Malware payload (Heodo)", "value": "88563926a80476d8da57c7239dcd33ca7e7185fd54b3542c1f48909fb345f30980e0db07504d373ec0857646c0bc76e1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347172, "uuid": "82bbed45-2508-4d82-889f-7e13f584a598", "value": "T162748C41E952C03CFEFB00B9D4D6C62AAD1E2E211B9D569F6244366D36603CF163F62E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347172, "uuid": "20cdd542-71dd-4c08-8b26-ce621566fb7e", "value": "79fb40281049052b3e354a6e444da473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347172, "uuid": "d450c20a-451c-4f8e-b6d8-8917a8a20435", "value": "6144:YFF10hIGpvmeY+wBuBqtrgummwYT4ahREWkOieUR6:yKIG5bEnmGcKS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644347172, "uuid": "63bd9acc-54c0-4c97-812a-af1774da094a", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644347172, "uuid": "ab1f0ac6-f1f6-4dd8-806e-b123146d6885", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347172, "uuid": "d289860b-cac6-4b2e-b4fa-e1458159ed15", "value": "emotet_exe_e5_2e5351d34f57efd766a17be45876e6c5fd1eb0f3f20cab75192696348d6a094b_2022-02-08__190559.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e674162f-88f4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644334596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334596, "uuid": "7ece0170-9130-4d68-941b-99c3b8743006", "comment": "Malware payload (Heodo)", "value": "330b13735be71195b3d68ada511aa5c6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334596, "uuid": "1f7b8704-e306-4c35-a78d-8425eeee19ce", "comment": "Malware payload (Heodo)", "value": "2e55dcb5e2d0e9c896f03f56173ba7ed87cf9bdc300328a1aab8b66d79326e07", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334596, "uuid": "c3144011-038e-4928-97e8-ac6a9f59de57", "comment": "Malware payload (Heodo)", "value": "c3515b497b9e6b90f27295bc4142ad53c3bc2a97", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334596, "uuid": "25828c4d-a4ce-4d07-b224-b6e57773957e", "comment": "Malware payload (Heodo)", "value": "c45f093d68d22476225ece4c4922bddad4bbae30d2e2010657fdae2f7bf0ea801a12e6105151ce953f722cab033188f3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334596, "uuid": "b49716b3-ee8c-4aa4-a6bb-64b62be58bbb", "value": "T101D38D6ABA48CE0BD94913314EE7CBF67336BC819F5297473295B72E1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334596, "uuid": "c674cde2-852f-4ff0-bf1f-3e0e0c5bc59c", "value": "3072:5cKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgFa3N:5cKoSsxzNDZLDZjlbR868O8KlVH3skeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644334596, "uuid": "0319e02f-7fa1-4a1d-a0eb-082e0f71cdf2", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644334596, "uuid": "62d615b7-ce77-4485-9e97-ce5a751bb1d6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334596, "uuid": "6d097a78-0a0f-41a2-864e-f8b9f9cf83be", "value": "Ommega_10.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77243e09-88b3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644306492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306492, "uuid": "dc7c8104-6457-4194-99c9-376089656230", "comment": "Malware payload (Heodo)", "value": "4fba0eced44c76c62d44339cab731eba", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306492, "uuid": "ca1435d2-1dd7-4c37-a3a8-1f07725cf292", "comment": "Malware payload (Heodo)", "value": "2e6d8e8cdba4701943260b0c96f0fd1c3c219d9b15c69b937e2762f27f38e422", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306492, "uuid": "08cf9ba6-83d6-4de2-9bce-d62083c9a49d", "comment": "Malware payload (Heodo)", "value": "af7b2446414a2fcc3a6280f743f98a9901df7cf5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306492, "uuid": "cf3831b5-accf-44ee-a556-ef67507e1dec", "comment": "Malware payload (Heodo)", "value": "aaa0d765ecca3dac89c7acf13afc772d18b8bcb12c2bb23a4ef57000c8696abfd08b7fc2aa484c8870e2b99818c02b3f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644306492, "uuid": "ee75edc8-d7b9-40b6-9c5c-e3a81134e39f", "value": "T1CD93499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644306492, "uuid": "f6155e4e-9f10-4140-9a2c-ad3766a1ae7f", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644306492, "uuid": "08f2d355-c979-4370-88c9-c28782875a46", "value": 96570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644306492, "uuid": "455089e5-2403-4b5f-8e0a-400306bd3b5b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644306492, "uuid": "528468ed-6e99-46b8-87ef-ee144193febc", "value": "tmpy755emd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3a964b-88aa-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644302745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302745, "uuid": "19bb5324-b325-4c3b-9a2b-e1b4a4d4c15c", "comment": "Malware payload", "value": "8024c9eb7cde1294d26f3ac439017055", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302745, "uuid": "b7984f97-1178-4374-8b61-b447924026e5", "comment": "Malware payload", "value": "2e80e34afab07f4266287c972d7d2d80e702d7fbf82db4eed34f9012d480bad7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302745, "uuid": "2dffb433-21c1-48be-8a10-bf94c976a692", "comment": "Malware payload", "value": "495f0b37eec4e292442226d53340960e61f3326c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302745, "uuid": "16a8202c-c02f-4b0b-9790-e17e53620966", "comment": "Malware payload", "value": "8d776ff18ed2c978720de089aa3bf1a449746b460c218c4d439fdd566977a9828914114a0edf8848aacdc43a1e7c5d59", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302745, "uuid": "116abd11-1f96-4131-91d7-a8daa9272b2a", "value": "T15C226A2CD749E41AD222053DD05642FAFB2D10A7A612FD4F208573DD4BA1BC387C6ABB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302745, "uuid": "26d4447b-f2cb-4387-ba52-4330882294cb", "value": "192:ScIMmtPXOG/bOZoR9vOlbH5SEzBC4vNqf97F77DM3j5b:SPXljvvOlbZhlqfZF78Fb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644302745, "uuid": "91fd6b2b-0ae3-4daf-8b33-f0836113d1c3", "value": 10335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644302745, "uuid": "759dfa87-25df-4a8c-8737-9d13c342e552", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302745, "uuid": "fe4e2567-d640-451b-a80b-df733be46665", "value": "27099788_20220118152009.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e37bb793-8876-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644280474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644280474, "uuid": "8a0b8c58-7702-45d1-991c-92cfea6b0b3b", "comment": "Malware payload (Heodo)", "value": "6d625c28da8384da15531400dc3b4bcf", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644280474, "uuid": "5aba4a1e-784a-457a-aa6f-296f13bfe00d", "comment": "Malware payload (Heodo)", "value": "2e98f48da42fcd30ff2966ec40273bbe43c33a1c5d5ae1241e46784238e8c582", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644280474, "uuid": "482bdd47-4648-47b7-9c3c-8344b34a8cb0", "comment": "Malware payload (Heodo)", "value": "52eb53ccf37e07d3d69c7bf78f0a863d20ad4e63", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644280474, "uuid": "b290f69d-4a89-4e54-a025-7c9f50e62300", "comment": "Malware payload (Heodo)", "value": "6054548c3d2f1c764e82bbd418d2bf5efbbb88d4be2336b51f90c35c698034d0d9cb71dea59a6bca2199a51999ba34a4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644280474, "uuid": "ec07f8f7-e5f6-4684-a7ba-9150cf263e45", "value": "T19793E12D7F5C5E0BD0CAF235CF3CDAA092155CE062A2F8BA64A06F7D513D493C166A6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644280474, "uuid": "224f2419-72ae-4fb7-bd97-654153f297cf", "value": "1536:zZRESsrwTuBtNYt6OklKUSKa3Xm1WBXz7yL64i+kkfa+3gtfvjHtoxzg5bjIF6XZ:zvbsMT8tNGA1a3Xm4nC5X5gxvhoxzMIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644280474, "uuid": "90c4f38e-0c31-4785-955e-d71354a6035c", "value": 94225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644280474, "uuid": "25823212-616d-45e8-8746-5a9f2da4d993", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644280474, "uuid": "ad128551-d7db-4240-8108-b1ae0f6a1a4b", "value": "tmp_we0v19n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f025fc34-88b5-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644307554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307554, "uuid": "54222a07-1adf-49fc-8428-cac049c50671", "comment": "Malware payload (Loki)", "value": "4cb97f33a27d1854fb4ac1b3b954cb27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307554, "uuid": "d3643f1b-983e-419b-bc30-8b99c2ed7038", "comment": "Malware payload (Loki)", "value": "2ed68e65e59325316e73d90be1a07071aff3f7e1431bd2fed94d06c1bd887fc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307554, "uuid": "7b16d12b-b568-4c1b-8abb-66f1641e2529", "comment": "Malware payload (Loki)", "value": "69d9dec386a9585d7ed43429f329cfe4d44ba06a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307554, "uuid": "f3c15cde-543d-4632-ae2c-ab747b8893dd", "comment": "Malware payload (Loki)", "value": "fa92220355ed486b2a18158187958d2f615b2cafdd1501e4111144a77e8336b8c33445bbf7b3eb4acb842f61ec99f2fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307554, "uuid": "81a8e974-95cf-404b-a232-f29d69698a83", "value": "T1CF246AE2A1C4FFC7D5BB62346EE536100B235B48281546509BDC292F37226CF3781B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307554, "uuid": "0149fd90-8148-401d-b189-b59790621340", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307554, "uuid": "5c39b125-2a4d-4bc0-a3c8-00a46aa2278b", "value": "3072:XfsQyhU6TgYfOTtFsOz+okFP98hly+9+H2q12PLjstzudlJAqjVNcwzA:ryhFO5lUFVGly+9+Hv2PySll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644307554, "uuid": "7a8569f9-96b5-4e75-8540-2b558f9830e5", "value": 209408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644307554, "uuid": "17153ae2-e67a-4b23-a4fc-973f3a621ce4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307554, "uuid": "ecce024a-de86-4bc7-85d9-70f2e4e093b0", "value": "Sat\u0131n alma sipari\u015fi_P.O_6935479 (\u015eubat sipari\u015fi).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b3a73d-88f8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644336183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644336183, "uuid": "02a9221f-06f6-4c11-b04e-9ed19f75bd0b", "comment": "Malware payload (Heodo)", "value": "d28fec91e032209d9b84bde3d913b5ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644336183, "uuid": "728a27ed-94bc-4f15-9823-ea9e7c589912", "comment": "Malware payload (Heodo)", "value": "2ed7acdaec9afc76515436db0a8d74a11ce004a87e4e7a558c9014140da5a197", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644336183, "uuid": "cd914d40-8f19-451a-856b-68405394ac46", "comment": "Malware payload (Heodo)", "value": "05198e83532d50826623fcd407907e52b9d4a8de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644336183, "uuid": "8d25b8f7-8c4d-4ec0-801e-d6ac80717858", "comment": "Malware payload (Heodo)", "value": "05e61d506414f97246d19fe2369378320f9e777623a34242aeda5107bb8712b7102a1ce4a0b7d6f340d10a5708f6a6d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644336183, "uuid": "089c1f3d-c068-482d-9b7b-5b3e2ead28f8", "value": "T1C7F4C0006582907AE4F930B842667BF1E93D1CB0372511D39BD069FEA6E41F1B6B376B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644336183, "uuid": "e4630101-36eb-4b53-baf7-de80327ca049", "value": "36d18f8cb3bee16af0421e6a936157a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644336183, "uuid": "40d17968-0b8e-4e30-95bf-4515ae9b225c", "value": "12288:lBseOTwOg957PAMTEFv49thrFcmxLFwD7wGcXbtzbEOpUDlBiawsoei4:keOTwOUPnTC49LJxJwaCOpUD7doei4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644336183, "uuid": "8a8f7bbc-aef8-497b-a7b7-ebe9ea30099b", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644336183, "uuid": "b10c5896-2358-40c1-8063-431f6d51e3f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644336183, "uuid": "7ec54636-1b53-414c-92c9-009c1851d7da", "value": "d28fec91e032209d9b84bde3d913b5ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c977d2c-887a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644281966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281966, "uuid": "1c505bb7-4e42-44ef-bfe9-4b90175409d9", "comment": "Malware payload (Heodo)", "value": "ae19466a625eb65d906f9c7e6bbbb945", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281966, "uuid": "41351800-271a-4fb4-82f7-ae2811631254", "comment": "Malware payload (Heodo)", "value": "2f028c1f9eff4bf835da1947647741ba50457414abe90b3488355e5cc7237841", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281966, "uuid": "0770e540-eb3c-4f58-bbdc-8c01fc6e4772", "comment": "Malware payload (Heodo)", "value": "ade17681629fcd509d788c713990efe299100823", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281966, "uuid": "891adbad-7f1d-4cb2-8b46-d32b1f740c99", "comment": "Malware payload (Heodo)", "value": "6caf56705974dc5d14f7964e22d6c18d4464e5a0ac6f27240d5e3aa7faf6b35083bf0b84269e648fb0bee5f87c6651d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644281966, "uuid": "a893197a-8555-49b5-9b85-fe5d45463e88", "value": "T1B8D429AB3A8FA1BDF17B017A6350FB44E4D27C1A9FBD25D70A86358893F2D054F18A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644281966, "uuid": "6ef4c0fb-22d3-4232-8bc2-6f54fb386754", "value": "bf1ebe22ec6f51f906ec295a3a5c6d92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644281966, "uuid": "62bf1159-79fa-4c61-87d5-ad3819fe67c6", "value": "6144:x42k6LwFPw91EDbkUE39P7pyADYzqlEDFmZ4s3wADtcvIpxUIVZFoEXlbeZhp4ga:x409qDb109PdyOYzq3T3fVbeFTi40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644281966, "uuid": "11e26a0c-06f9-489e-a0a2-2f14be0eb5b5", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644281966, "uuid": "eac60c2f-0dce-4a2b-b768-f0d7c9cfe88a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644281966, "uuid": "761bf693-37a0-48dd-99b3-f0b48199ea0a", "value": "ae19466a625eb65d906f9c7e6bbbb945", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae202083-88c1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644312597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312597, "uuid": "bfadb80e-35cd-4881-b4a0-f94f2b99f16d", "comment": "Malware payload (Heodo)", "value": "c3144e4cb1da3a3360db245c92c96196", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312597, "uuid": "acaace86-19a9-4b53-a494-0529c0fec71c", "comment": "Malware payload (Heodo)", "value": "2f2d2b58dbf33f7b4d305ec25f24ed3846c61c0324b5e6a09a193cec429aeed7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312597, "uuid": "c63484a1-3c96-497f-9be7-dbefbdb69e9d", "comment": "Malware payload (Heodo)", "value": "49254f940adcacd67a6f5ffb9e2d653f4bb7aa18", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312597, "uuid": "3632abec-f1c8-4d89-8328-8f4bf1d8e2fe", "comment": "Malware payload (Heodo)", "value": "1665fc3ee6a667e0502869a18d83fd79f3cfeae19f5bab0f2bd8397f0ac420f95b2d7cc4c1ce955f20160c5b8f3c3da1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312597, "uuid": "d88feeb5-7a3c-4c2b-9229-8af4250f595a", "value": "T19393499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312597, "uuid": "301cfe6b-3cc6-430e-94fd-8253b6ec6ad6", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644312597, "uuid": "c4440fb6-cd28-4afa-8290-bb1c61cc1080", "value": 97143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644312597, "uuid": "50e233a7-bdd5-4aec-9fb1-2c2ae13977f3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312597, "uuid": "5a85750e-96ce-40b1-84ce-b438b1d1f27e", "value": "tmp0y18cnpp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87487ec7-88c9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644315968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315968, "uuid": "2dc0ea50-d8e2-447b-92cd-f7dec0d763b2", "comment": "Malware payload (Heodo)", "value": "b6ed95607e258834c4ba96e428108df7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315968, "uuid": "5e677da7-a7a5-40c7-99b5-847b1f3cd436", "comment": "Malware payload (Heodo)", "value": "2f364babf86f18875c20ea30aeb850651e90fc0493d2fd34ca034131febe72bd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315968, "uuid": "364c2086-3db9-4b3b-aecc-58450533c37c", "comment": "Malware payload (Heodo)", "value": "0c4ab062615044571d54b8d80f51f49ec8f412da", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315968, "uuid": "6c9ec650-7e7e-4aaa-96ea-083df4ba6cd4", "comment": "Malware payload (Heodo)", "value": "efa22ba8820635ad0309d1787dc71113224865730fd38ab42607629811a4c66472b4978cf237580f012781ea9c3cbfb1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644315968, "uuid": "a47e0344-d759-4f22-8965-ef4a2ff3bee3", "value": "T168F4CF01B642C07BD4E920F882677AF2DA3D1DB0632511E75BD459E8A5E42F1B6B3B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644315968, "uuid": "d4ff95ff-240c-442c-b0fa-4ef76adc799a", "value": "36d18f8cb3bee16af0421e6a936157a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644315968, "uuid": "3603fae1-391e-44cc-9c90-74db11d30cd3", "value": "12288:0dxTcumr82wywP4LHIVBIAeQwfUgFm9V5BnE+skDSBXOgl16gtdXkX:8TrmrRwP4kVfw8gYtE+skD+XUgTXkX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644315968, "uuid": "3bfdeb15-a44c-4744-b7de-752939229cb5", "value": 781824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644315968, "uuid": "7e8c4a8b-1c3e-48a1-9f40-25b353379317", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644315968, "uuid": "f4dd4c9a-4ef2-4612-b2c4-894b070d063b", "value": "bneuihlows.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913d4800-88ac-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644303529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303529, "uuid": "9eaafa56-4fc4-4051-8e59-057d36383aac", "comment": "Malware payload (Heodo)", "value": "8f90aa936ab3c05a0e94cfcb81e65cc0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303529, "uuid": "9e77c964-db74-4a11-9312-d2dd0869c8a7", "comment": "Malware payload (Heodo)", "value": "2fc9a3959ef469a9400f3c4f914bbf9569267263d78478834749d1138710e0a3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303529, "uuid": "a8cfe1cb-ead4-4bff-acfa-6d29d1eebbd9", "comment": "Malware payload (Heodo)", "value": "c1939bab9ec79d602ba967d4ffc9c55dfb9e33c8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303529, "uuid": "aa83e4ab-d477-4c7b-89af-9bc900ba5967", "comment": "Malware payload (Heodo)", "value": "8d2996a1373a1fc248f6487bfa5b2b63da790c1cb7a2d59b6e86ab280546a68b6ddd72c7e0d91916e7c1596031eb7cf0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303529, "uuid": "9ab55dad-0d00-4325-b2d3-b775f24be589", "value": "T1AA93499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303529, "uuid": "52035675-88fd-4413-9ffc-93fc4271d2e1", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644303529, "uuid": "07c288a2-dac0-4cbb-abdb-dfec5f3edefb", "value": 96341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644303529, "uuid": "566eaa2e-8370-4262-a057-5c859088993c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303529, "uuid": "18e6876a-5c38-48f5-8acf-81f2afcfb2a6", "value": "tmpzgt631lt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adee7c49-8928-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644356835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356835, "uuid": "d451de7a-720b-4669-a1ba-68c6666f2a20", "comment": "Malware payload", "value": "4619fd457cc8aca23abd96c4d24e48f4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356835, "uuid": "074bfcf3-5945-4cb4-9374-3ba7ba10946c", "comment": "Malware payload", "value": "300d0d9d2da78ca77d5f92434b3adb23856bf30374bb8048c9667af0207bf484", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356835, "uuid": "153f6294-4d1e-4663-abfd-c4a718df977f", "comment": "Malware payload", "value": "b6d326c44e8677044c8062f46f9fbb15b56438ea", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356835, "uuid": "ac62f7e8-9146-4778-b3d0-6386d66058d2", "comment": "Malware payload", "value": "07cfda00c308862dedd7a0f73d4c855f2e61b998c73645e92a04a4f92748dd7d81f695b3699a1a88d3c52e391a5cb023", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644356835, "uuid": "335e37d7-c0a8-41a5-85bb-303e7ab590dd", "value": "T172C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644356835, "uuid": "3d47cdf2-af63-4a21-b268-4cd5e9b617d1", "value": "3072:XwcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBk:gcKoSsxzNDZLDZjlbR868O8KlVH37keM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644356835, "uuid": "d7330af3-078d-4260-8da3-7cc410640549", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644356835, "uuid": "25462a33-fffe-45d4-978f-ca404c6174fc", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644356835, "uuid": "2c909c32-8e65-4375-a2d3-c2f45e34999c", "value": "tmp2t8khsob", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16fd876f-890a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644343697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644343697, "uuid": "c8be1939-02ca-4e62-a149-206ba28f774f", "comment": "Malware payload (Heodo)", "value": "8139e88de2cf5e0a510aa83a2d2be889", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644343697, "uuid": "7a3d3639-8ad3-4645-aeff-306a25c7d731", "comment": "Malware payload (Heodo)", "value": "301dd983baeeee90add4a24343a8713ac82deac2167ff8c72ece117f96e09e80", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644343697, "uuid": "a54fb41d-2e6d-4349-943f-370c9f73cbb9", "comment": "Malware payload (Heodo)", "value": "2a4ace9d60b0501f87f9967bd06fb2d0daecae9c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644343697, "uuid": "1eb4dfb6-5ca5-4453-89f6-605f4e7afe30", "comment": "Malware payload (Heodo)", "value": "c79bedb996b13c0906668eb039f5e1def3c38b3fed1a4e5d6db99775fdc989ec5aa2cc31770e8c8ffeb0a7621b19aa8b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644343697, "uuid": "66fc05e7-cf1f-49d8-b1d4-3da22734a223", "value": "T116C35A55F685EA1ADE0822350DDFCBF97336BC828E9683473299B32F3D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644343697, "uuid": "39d11e23-f44e-44e9-a4ed-a2c0fcb79461", "value": "3072:srcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgiBx:wcKoSsxzNDZLDZjlbR868O8KlVH37keU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644343697, "uuid": "04ad32f3-b449-4bb4-9ed9-aaeb644ddb12", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644343697, "uuid": "f3511b5b-bfa7-499a-8d4e-713cc92cd6c6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644343697, "uuid": "82c9f50f-71ca-460f-b9bd-56a229cb1fa2", "value": "tmpr21f0jgw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "351363f2-8923-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644354484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354484, "uuid": "23abab23-9ae8-4e0a-8087-dedf6f2801b2", "comment": "Malware payload (Heodo)", "value": "cea298ef1cefc16649cd447c2ceee32e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354484, "uuid": "b92748f6-77d9-492f-82ff-51f6cfe52d0f", "comment": "Malware payload (Heodo)", "value": "3052c104d4efa2dfeda445707c7cdbdae1b39de9f08e0827638001e6a912d035", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354484, "uuid": "fba3a498-8e7c-496a-9e4b-acfa8b9cbf43", "comment": "Malware payload (Heodo)", "value": "36c23889909cc2166c0ab946124dfa4c850bb754", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354484, "uuid": "bf69e74b-6238-4b89-8ccf-fdfe602f9931", "comment": "Malware payload (Heodo)", "value": "430ecca8dbc940182025a50fe0003944771569787158e72ef4818953a488cdf8261328e4e977f9cc74a968af561b80a2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644354484, "uuid": "b9b5cdba-5553-4723-925a-55be7a2b11a2", "value": "T11AC35A55F685EA1ADE0822350DDFC7F9333ABC828E9683473299B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644354484, "uuid": "029e1744-35d0-47c7-9693-67cdc5cc587d", "value": "3072:P4cKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBG:gcKoSsxzNDZLDZjlbR868O8KlVH37keC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644354484, "uuid": "0cb4afd8-2f1c-41d1-a6de-74a38c3b99e6", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644354484, "uuid": "f6d64e75-9e5f-414f-be8e-71decf58d5b1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644354484, "uuid": "3998cb78-9108-4fa0-ab9b-4f06e6de2511", "value": "tmppw9p3pbp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7a08d5-8915-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644348730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348730, "uuid": "0a0cbc4b-c84e-4430-80dd-a814d63ccbcc", "comment": "Malware payload (Heodo)", "value": "5d5b8595ddb61da6e8d4ec28d54a9199", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348730, "uuid": "3b9ca119-75ab-47f5-bc6f-57ed8cca5cb6", "comment": "Malware payload (Heodo)", "value": "308bcfce40ddb9ea57a8cc60db0f99bda776d4379fde371a54fbdbfdef114708", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348730, "uuid": "1e937c6c-5889-438c-bf7d-980724c57673", "comment": "Malware payload (Heodo)", "value": "940f2611dfaf61f633195e5c7577b69a5f98d3b9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348730, "uuid": "54566b7c-8278-4165-a039-b6146aef9078", "comment": "Malware payload (Heodo)", "value": "0ce6e0fd84b5d0f4789af9f78b0496406d835201a8b0eeca1429bcf1cbc5de097af02cc443321706f2fe30646652f71a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644348730, "uuid": "68654518-4347-4012-8db4-9801fcc2dbd5", "value": "T1CDC35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644348730, "uuid": "cf1d5b84-7063-4b4e-88ef-c93d9997a42b", "value": "3072:OpcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dg3Bm:QcKoSsxzNDZLDZjlbR868O8KlVH37keW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644348730, "uuid": "9303ec46-ef4c-4400-b1f4-edb4465b9d43", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644348730, "uuid": "75065c77-528c-442c-b974-7fba89e937ac", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644348730, "uuid": "fbafa30a-eee4-447d-ab9f-34cd23fcb30a", "value": "tmpqawg_jgr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "861c7706-887c-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1644282894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282894, "uuid": "38c57445-37f2-41cb-a602-99afc87e897a", "comment": "Malware payload (njrat)", "value": "ed546d0832f3d13b4c05a813b7460949", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282894, "uuid": "33d95522-b847-4efc-8032-78364c933ee4", "comment": "Malware payload (njrat)", "value": "30910cd8f9de56b9dbdb4157b9ddb769b52bef499cfebd0e7f35303cdf4968b5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282894, "uuid": "52f08d25-a106-4538-8d56-65c24d29f563", "comment": "Malware payload (njrat)", "value": "4ed4027689a70838c382c62bd2a0aa03c65c5aff", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282894, "uuid": "ae706eba-068f-44d0-bf38-88a94ca8a554", "comment": "Malware payload (njrat)", "value": "d881c1576e23fff327fd73048b47e6fe611b3e7ff61300311ec955671bab9953865dee211cbcbf2b307f731a5b581cd7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282894, "uuid": "96f12372-3bb4-4033-b80c-31b497e76332", "value": "T10512193C42754AE9CF8DA2F6673AF80A00DF7E6A53C4E99376BCA3106F5576D1207440", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282894, "uuid": "d9f2a22c-b1fb-4c78-af66-4fa9535310df", "value": "192:/kmVVhNUqhq59FQHoYNk+CJp+jpJH2mS+MzjVlnErcXj40trNfRo0YP:cgqX54pk+CJ4DH2j3nErmE2fu0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644282894, "uuid": "0d266828-0f84-4c34-b02e-44fdc8c05664", "value": 9445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644282894, "uuid": "075a1839-694e-4c6f-bf60-e9090935edf8", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282894, "uuid": "d13c5f60-974b-4871-813e-5fd35e2131d2", "value": "purchased-73821321724.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5234cb0-8896-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644294167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294167, "uuid": "b610dbac-aeb9-40a2-ace5-12296278ddb7", "comment": "Malware payload (Heodo)", "value": "a427e79e0e78f405fb1abb607a33995b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294167, "uuid": "f9602ec3-3b32-436c-b1b1-88e2569ca50b", "comment": "Malware payload (Heodo)", "value": "30b55c96f0dd1fa97f332ee3788f340207b077497aa90354f363b2919571f161", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294167, "uuid": "e3503b66-2c65-4ff6-91fd-116eab1f8a82", "comment": "Malware payload (Heodo)", "value": "f3ccaf9e3c3a35fbf720547fd950e584f3557779", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294167, "uuid": "56b836b2-3392-492b-94cb-38506bb63376", "comment": "Malware payload (Heodo)", "value": "c1432a7ec8752b8c451839154676db346f4328049b32a9e6d3c78d63a5c534398cd185f6b7207df4d0666edfdc7dd2a0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294167, "uuid": "f538b08c-745f-4f9a-a312-6835215b245c", "value": "T118D38D6ABA48CA0BD94913314EE7CBF67336BC819F5297473295B72F1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294167, "uuid": "c7081336-d8c3-41ba-8491-635cfab3c129", "value": "3072:3cKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3Z:3cKoSsxzNDZLDZjlbR868O8KlVH3skeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644294167, "uuid": "e174fc24-1c6e-4756-8920-5d878f473e85", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644294167, "uuid": "4204e9df-6b2e-4d65-8c48-ab6a3b099148", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294167, "uuid": "e29d155a-8039-49f8-a1d4-c089c0b62148", "value": "tmpbj_al783", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f70658f-8912-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644347173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347173, "uuid": "ce2fc188-65e2-4acb-9903-b6bb54869889", "comment": "Malware payload (Heodo)", "value": "28c72597f25f3aa03d991ebd57be322d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347173, "uuid": "17e387ec-5ca8-431a-a393-4f6d945f2b8a", "comment": "Malware payload (Heodo)", "value": "30deff78b0c73e9bb1c3d20d6bffae7ec11c7fbe4d21204c3eb589e65876223c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347173, "uuid": "b8b159f4-c6d3-4288-b856-7bac80c40e29", "comment": "Malware payload (Heodo)", "value": "92cc1bfefc314c91b17d668dc02525b97f32a360", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347173, "uuid": "0d18a58a-b5fb-497e-93bf-5a2b060f4668", "comment": "Malware payload (Heodo)", "value": "5641c9138559cdd704f73beea44be553a417780d70c343e6cc047164cf9c4bb5d45d4b9c07c3b3d736b3f597c6e8865a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347173, "uuid": "6bfa9465-bf7f-4c26-9c9b-d432a6705867", "value": "T109748C41E952C03CFEFB00B9D4D6C62AAD1E2E211B9D569F6244366D36603CF163F62E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347173, "uuid": "0a70cca6-6573-42be-90f8-c65209e57637", "value": "79fb40281049052b3e354a6e444da473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347173, "uuid": "12de9ba6-114c-4d4c-ae52-d290d6f02dd9", "value": "6144:YFF10hIGpvueY+wBuBqtrgummwYT4ahREWkOieUR6:yKIG5zEnmGcKS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644347173, "uuid": "2d033290-079f-413f-a85b-f74bb3d12ced", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644347173, "uuid": "a5375df1-6f54-4453-a02c-f8b4484a277c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347173, "uuid": "ed9d0d06-48d0-498a-97f6-c7c6d07570cc", "value": "emotet_exe_e5_30deff78b0c73e9bb1c3d20d6bffae7ec11c7fbe4d21204c3eb589e65876223c_2022-02-08__190605.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7aa7e71-889d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644297178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297178, "uuid": "1b9977d4-43e8-4660-9a9a-3fd31f30cfae", "comment": "Malware payload (Heodo)", "value": "79316aa0ed7a7bd998712fbe633ec614", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297178, "uuid": "464b30e1-c181-4a96-aaa0-6329ff0cb7df", "comment": "Malware payload (Heodo)", "value": "30f69b7f6a1b828e730cd5c7d6937405885799e0c448b837bda0989e779bab8b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297178, "uuid": "3b8e512c-cbae-463e-bf65-4ea0b8afc6f5", "comment": "Malware payload (Heodo)", "value": "42e6ab0b6b41e2d235e37e552e01209b0f1a66d9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297178, "uuid": "8f2bcdde-1cc6-4d78-93f3-af8cce9f3683", "comment": "Malware payload (Heodo)", "value": "79e3fe95b2bf4317955ec3ccfd5289f831af4ecdfcc2cbd168310cb7f48d1b4cab45ac1d2db3edb642fb33a5bb85bd5e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297178, "uuid": "2643897e-0cf1-434e-8ad3-33b4d56308b9", "value": "T137D38D6ABA48CA0BD94913314EE7CBF67336BC819F5297473295B72F1C3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297178, "uuid": "5411dec1-6506-4cb7-b183-3fe3353c2a14", "value": "3072:OcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3i:OcKoSsxzNDZLDZjlbR868O8KlVH3skej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644297178, "uuid": "cda79cb3-66d6-4d89-8516-a314221bbdef", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644297178, "uuid": "c34f29f6-0462-41a5-a1c4-40ddb1745122", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297178, "uuid": "35e21e70-f1a4-406d-8791-6d6d00cce48c", "value": "tmpyarhxn66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fbcbfe6-8872-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644278455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644278455, "uuid": "0721207f-ff50-4e77-ae77-a162edfc1681", "comment": "Malware payload (Heodo)", "value": "2b596050f220ce0d74051e6c4be3a64c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644278455, "uuid": "ddf9d28d-a6d7-4ce6-b5ef-802123c5b920", "comment": "Malware payload (Heodo)", "value": "3135fabe0b8677d10d8f51212e5a4b271790c5cc2c983f351e7caf79d053ca5d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644278455, "uuid": "65d98427-13c7-4ed4-96c5-b7094ddadce8", "comment": "Malware payload (Heodo)", "value": "6c76d4b58f144efd8c43b1617dc2507af152d03e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644278455, "uuid": "0ae519c8-2cc3-40fe-b9df-b880992ceec8", "comment": "Malware payload (Heodo)", "value": "24b4662c94508e3f76313d9f4d8f70de9ea521c29172b2a95521e340838cbe5cbcb698ad9f73fd5afdf6877399e6422e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644278455, "uuid": "7152393f-f040-4871-bd34-05cb9a4f0abf", "value": "T1B3D429AB3A8FA17DF17B017A6350FB05E0D27C1A9FBD29D70A8A758853F2D054F18A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644278455, "uuid": "f5777cfb-26d9-4d86-8aba-6e5c4dba7711", "value": "bf1ebe22ec6f51f906ec295a3a5c6d92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644278455, "uuid": "25f76cae-972b-49b7-99a4-1d7c0347962b", "value": "12288:l4WjRiEKWKhqyuYzqtNSH2AyKK6cl788IO/:9KWKh/ZqtU2AJuQBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644278455, "uuid": "83702dd2-c8d3-4539-a61a-a2d5a418e7c9", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644278455, "uuid": "fce95f0d-2839-41a1-8bd4-6b40f181fe53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644278455, "uuid": "a79fb383-3f79-4f23-a72c-7f34c5c67bcb", "value": "emotet_exe_e5_3135fabe0b8677d10d8f51212e5a4b271790c5cc2c983f351e7caf79d053ca5d_2022-02-08__000049.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53f6bc8-8903-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644340982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340982, "uuid": "f30df8e7-c941-457d-8160-133ad1387182", "comment": "Malware payload (Heodo)", "value": "322500edd49c7cde94cd4e51fa0b269a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340982, "uuid": "29d370f7-7581-48e6-9e12-200b4a6048fb", "comment": "Malware payload (Heodo)", "value": "31b2075e5b15913c75387b6a8a389f957f9d7161b55e62132cb7ffa96a2445b8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340982, "uuid": "837c22ad-3317-4549-9eb5-852567487466", "comment": "Malware payload (Heodo)", "value": "d65ee2a44b7d3e62237b59a4c495129a7ab8cbfa", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340982, "uuid": "95cfd5f9-a4fe-4c5a-88db-c5397e618c4f", "comment": "Malware payload (Heodo)", "value": "dd67f93255671170cc2833ce3d9fa55c179f9e80c50ad6d3f2ccbf31ffcbf878c17228c2b1252d20d0895865dee46623", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340982, "uuid": "da93b4a5-2995-45b3-b871-82287c322baf", "value": "T1CEC35A55F685EA5ADE0822350DDFC7F9333ABC828E9683473299B32F7C76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340982, "uuid": "4c69ef08-e23e-4fd4-8c9a-1681576cf570", "value": "3072:URmcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLe:LcKoSsxzNDZLDZjlbR868O8KlVH37kec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644340982, "uuid": "fc79c886-080a-4aec-ab8c-10981690ad69", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644340982, "uuid": "fa23d652-bf86-4c69-bf8a-ddd080d08ee8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340982, "uuid": "b1dc4e17-8fae-4e4d-b241-dd70ede4e2d6", "value": "tmpkixmi2vy", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f238fe8b-88a4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644300256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644300256, "uuid": "e4decc47-0036-48a0-af2a-59f8c160b7da", "comment": "Malware payload (Heodo)", "value": "84cf9cbee49913c8827409347c653103", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644300256, "uuid": "6e56533d-cb01-43da-8a1e-3b2c3f75849b", "comment": "Malware payload (Heodo)", "value": "31eea9e3f6c5cb7dedb21ee8396fbcd7cd708301fe6c7789d777d78dc2bda942", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644300256, "uuid": "992d9f2c-6938-4ec3-afc1-a0c536302121", "comment": "Malware payload (Heodo)", "value": "3a57ec3e731f38afc1ac477139603fed7b3ae650", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644300256, "uuid": "80ad3799-8d5e-4b02-b250-04fab11dc0d4", "comment": "Malware payload (Heodo)", "value": "eb3033848a77299b3208ee5d40813d00d863d6062afab7e01c9baac8a24645dcf02257da5099169ecb163a06b83f991e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644300256, "uuid": "8d2e5d37-f2bf-4270-a81a-d80dfd6bfa7d", "value": "T1A393E16E6E1C2D0BE1CBF138DF39DA6083255D9076E2B9B950A12F7D103D493C1A6E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644300256, "uuid": "0dcce152-5be6-4268-b320-456fd35d00ff", "value": "1536:zZRkPTsjkn7dQGOr5zSKa3Xm1WBXz7yL64i+kkfa+3gtfvjHtoxzg5bjIFfm:zvk7sjwpp0Na3Xm4nC5X5gxvhoxzMIVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644300256, "uuid": "aded4275-bf1a-4ea2-8be9-8dc4b39f6df8", "value": 94232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644300256, "uuid": "97a57a36-28b6-4d22-ac3a-3b0ec530fa1a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644300256, "uuid": "69441787-9eeb-49cb-8e34-2b9257971a94", "value": "tmpcd9sat2l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a090bfe-8886-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644287196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644287196, "uuid": "fcb7f0b7-dd0e-4dc7-9306-957f2de5242f", "comment": "Malware payload (Heodo)", "value": "459e7b94b1b6ae8f794cb72373ae7323", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644287196, "uuid": "0b5a9502-c11c-48d3-9301-1d83ba2b99a3", "comment": "Malware payload (Heodo)", "value": "32145e13713e4316e76f9d3a26e0a924046831a4bfc278e13b92a4ec5b04df45", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644287196, "uuid": "7a3ef35f-5e84-4c5f-91d0-28264b67f4a8", "comment": "Malware payload (Heodo)", "value": "f80efb76dbb3aca47d5a65fd932a4d2d893858f7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644287196, "uuid": "266a392b-6e89-4c71-8e75-ca673e1e3be0", "comment": "Malware payload (Heodo)", "value": "ac6185bdb82c2d2ddc9c7871643c9949d4b99ee0663aa02895e660b31a9c38e537c7e0b060f075c7291a789610a201d1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644287196, "uuid": "b282e932-a0d1-473f-b199-4a20efb42999", "value": "T180D38D6ABA48CA0BD94913314EE7CBF67336BC819F5297473295B72E1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644287196, "uuid": "821e5d07-526d-492d-91ca-a6da54fd642b", "value": "3072:lcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgDa3R:lcKoSsxzNDZLDZjlbR868O8KlVH3skew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644287196, "uuid": "9ab4a447-f8e3-4cf6-bab5-71dac266a9b8", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644287196, "uuid": "96f86466-7eed-46d1-8824-214b7e71fb08", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644287196, "uuid": "1331457a-0e79-48ef-86ff-ac282e7a6dfc", "value": "tmp_rnpbs7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9722d20-88d5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644321233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321233, "uuid": "0fa0df9c-0bb0-4850-98f3-4fca5e25e828", "comment": "Malware payload (Heodo)", "value": "08fb8c197f6692315ed002027037895c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321233, "uuid": "303eaeee-87b7-434b-89a9-91b0a6437e57", "comment": "Malware payload (Heodo)", "value": "322a411b10228ffe835d89bbd57a6585f4a568804df221c523ea5ee1281b5b5b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321233, "uuid": "1429e683-c888-423e-be5a-2a1bb201f2a9", "comment": "Malware payload (Heodo)", "value": "658854aebb0ff63fb9f50ab955d7043ac43bf63d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321233, "uuid": "8447c54e-6921-457c-9750-7650ed20527c", "comment": "Malware payload (Heodo)", "value": "a337887d723a96305ee99435b8abde100b93b8ecb0e60121a9c98165997a88a67b5618682743b103e559ae94646ddf2c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644321233, "uuid": "a919e780-b0e0-4a34-ab51-0903d54a2db9", "value": "T11DC36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644321233, "uuid": "a1488ca4-23bb-4857-8b6c-b78fbc88b870", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644321233, "uuid": "03d20ca5-bbf8-46cc-9448-7b422905eda9", "value": 128365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644321233, "uuid": "e8de0793-d528-4593-955a-0cab32698f5f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644321233, "uuid": "5a2c4375-425d-436b-8775-bb471f5c87bf", "value": "tmpjf188cyv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3101405e-8872-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644278457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644278457, "uuid": "abb67b3c-aff6-4092-8514-5e02232dd81d", "comment": "Malware payload (Heodo)", "value": "e763e608b3614f2eab62631a29e584e1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644278457, "uuid": "7039c80d-2da8-4778-9bdc-50ebbe18dbb3", "comment": "Malware payload (Heodo)", "value": "324404cf02d5ec074f28ed3be11c59c6b3634648e1a76befe17519cae1867dfd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644278457, "uuid": "e3d22437-4a5a-48b4-a6d7-3d3331d6f094", "comment": "Malware payload (Heodo)", "value": "ea1b569489708b270099d55abaad15ecc79ed4af", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644278457, "uuid": "f76ec711-5230-4495-bc3a-5efbde2f7fc9", "comment": "Malware payload (Heodo)", "value": "82fbbec71af89afc5146175d704010d70e302d56b1d99680d12b40960ecd23fdc1ef33037d10551106f089a95bcd7c0f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644278457, "uuid": "4dd99b9e-05f7-4d62-a0df-14a03f8f0edb", "value": "T1FBD429AB3A8FA17DF17B017A6350FB05E0D27C1A9FBD29D70A8A758853F2D054F18A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644278457, "uuid": "dba54cc2-0c96-431e-9ec8-e48508cd8bbc", "value": "bf1ebe22ec6f51f906ec295a3a5c6d92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644278457, "uuid": "a951f3be-6fb8-43c1-aafd-9eb438852db6", "value": "12288:l4WjRiEKWKhqyuYzqtNQH2AyKK6cl788IO/:9KWKh/Zqt62AJuQBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644278457, "uuid": "dc8f65da-d139-4b60-9723-229878e94b8e", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644278457, "uuid": "6db6a78f-1934-4fda-8618-0b43716ae6ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644278457, "uuid": "67f503cb-4241-4b71-a29d-483a642549a5", "value": "emotet_exe_e5_324404cf02d5ec074f28ed3be11c59c6b3634648e1a76befe17519cae1867dfd_2022-02-08__000050.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "129537aa-8937-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644363016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644363016, "uuid": "acf31d5a-117a-4d1b-bde6-d4f1dc62a6ec", "comment": "Malware payload", "value": "d6becf1ae32ed969a83e909b0423e453", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644363016, "uuid": "86cd8e3c-c2b2-43ae-b43c-f96bb801646a", "comment": "Malware payload", "value": "328abfa78f780989b574b578d9c97797700e5ce59416fd921e6b610078a4f6eb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644363016, "uuid": "f937bf51-02d2-4870-89c2-3783b369c30c", "comment": "Malware payload", "value": "cd6a119732f29db6732b7c38883786125cb4140a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644363016, "uuid": "322e6284-bc8a-4abf-8f11-d8ddfd65d2b0", "comment": "Malware payload", "value": "9be8ec98413c3d5611e9ec5a5d4ab9ee872cb751b7b250df6df89247e6fb879f44b6d00749f835cd38e9d0064b194a41", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644363016, "uuid": "b94a2832-a9be-43b5-8191-087205c76e14", "value": "T12EC35A55F685EA1ADE0822350DDFCBF97336BC828E9683473299B32F3D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644363016, "uuid": "97a57c7d-e9da-4be4-ba93-960049030d79", "value": "3072:uEcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgiBN:1cKoSsxzNDZLDZjlbR868O8KlVH37keQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644363016, "uuid": "749a5b48-741c-417e-b3f5-260fb0abd6d3", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644363016, "uuid": "4d9ab439-d240-4fa2-9348-8b728f41e52a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644363016, "uuid": "0766345b-650c-43a6-ba7c-bf079ece2c2b", "value": "tmpzu_3dzs_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c47b5f-892d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644358782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358782, "uuid": "e72ce4c6-e6d9-4c31-a10c-f4e97c6f74f5", "comment": "Malware payload", "value": "6ceab53f6a79332d16f819925725bf6e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358782, "uuid": "d31d0b00-40e9-4603-802c-ef9685c4a306", "comment": "Malware payload", "value": "329b64bb28b76bd067ac5c320464c54dd6aa71c55a45eb9164593ccd6dd1f3a2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358782, "uuid": "a457eb61-e031-4054-8c4f-637adb4db749", "comment": "Malware payload", "value": "611de52ab4e0cefc7d4bd44dbd9ae2c0f86aeb0b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358782, "uuid": "8da668c6-3855-492d-a6d4-df3a1e8d9957", "comment": "Malware payload", "value": "d817201c73a888a00008e881249fbc57d7b3eac693fc82549cc0c5e55ec12e8115534a70edd3c104b85091d572a861fb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358782, "uuid": "2d08d9dc-fdd2-4193-b9b9-20c67f294a8b", "value": "T15AC44B13E68398F1C79C803973AD7BFF802A155547E876D30BF1858869AC0E14BB7D9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358782, "uuid": "26660a92-b38b-4900-9901-7fd1b2557d7f", "value": "1059dec3a72d4c311e39c8fc33d5af98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358782, "uuid": "1f1d951f-c3eb-4b28-a8d1-fe0bf38b36fa", "value": "6144:/mbbvqXJery1jH9OttfeRdq9r8BVBALMaXac9e8h2qYJVwdFmFlE/S:QbvqX4+eKdq18mLRXTeg2jJ0F9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644358782, "uuid": "7a046d3c-258a-4552-8b05-5dd40702fa53", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644358782, "uuid": "b9d97b01-b576-4ca0-9028-762206ae4414", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358782, "uuid": "89090392-78c3-4365-8afb-b1652d9ed763", "value": "emotet_exe_e5_329b64bb28b76bd067ac5c320464c54dd6aa71c55a45eb9164593ccd6dd1f3a2_2022-02-08__221929.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd6b7fb3-88b5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644307495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307495, "uuid": "1dee6ef7-a6ac-470c-8b7d-3dd959a3fd47", "comment": "Malware payload (Heodo)", "value": "a242c0cd25be86c7d3877960d39bc45c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307495, "uuid": "35d70c6e-620a-4941-bc75-2b78caf8cc01", "comment": "Malware payload (Heodo)", "value": "330c83b6507cf50e3946cef79f75f447379ff9b234f92c9cd4ed24d5f50d6231", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307495, "uuid": "0f4f8294-dfe8-4fe7-a56a-4c5622dfafa3", "comment": "Malware payload (Heodo)", "value": "aa4c61cd738df7f9c8139814bab4abfd7953d147", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307495, "uuid": "70026e33-9b44-4782-90c8-0eb2a73f0e10", "comment": "Malware payload (Heodo)", "value": "f07adffe8101b07b305c45b8f0c64a314184a5f060f415992eeef7394d72d1eaa3aa90ece65d4356c96e8327daa10915", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307495, "uuid": "ce1bb8fc-0676-4d24-b568-4a16303e0be4", "value": "T17F93499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307495, "uuid": "f8607b55-7e72-4603-8c08-d5623bd2ce07", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644307495, "uuid": "dc1b3cca-ba68-4368-a73e-c760c43d149d", "value": 96773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644307495, "uuid": "0fddc79e-76c6-41f0-8139-5abe55849a75", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307495, "uuid": "539dec37-e509-4de0-a58a-7994a9609cdd", "value": "tmp_dqfd8_j", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b19c4f85-8899-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644295423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295423, "uuid": "c15f42f7-0b05-4ceb-a8e2-50f08510fdb6", "comment": "Malware payload (Heodo)", "value": "052e466b8aff67492cb2ff39c7d53ec8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295423, "uuid": "8657c1b2-f170-400a-a5cc-3bce2293e747", "comment": "Malware payload (Heodo)", "value": "3319a32f18faf639070234d5499494f26efeb4681039d2ec8826807b063a3020", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295423, "uuid": "4c4ceb9c-b631-47d5-87f5-82a2b61f831c", "comment": "Malware payload (Heodo)", "value": "4f7bef0ac7bf62cd599361adac9d4b157451d8ee", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295423, "uuid": "e3c8d190-b17e-47f7-80f0-a7ef2fbc1d88", "comment": "Malware payload (Heodo)", "value": "95f1c4d09c410bad004afde3f128f8665ebe216ca671006d5ce37ae75fc539fb8a62bf73350f4f03714f8ef1b44ed0a2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644295423, "uuid": "2f787e00-0df3-4d08-aa50-3ad41c5058a7", "value": "T128D38D6ABA58CA0BD94913314EE7CBF67336BC819F5297473295B72F1C3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644295423, "uuid": "f32a325f-f77f-452a-8b6b-84ad3ccd4d62", "value": "3072:McKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3J:McKoSsxzNDZLDZjlbR868O8KlVH3ske0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644295423, "uuid": "3727ad11-8f84-4987-8327-e91d102f3bf1", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644295423, "uuid": "8f03404b-35bd-4a2c-b40a-d77af7c019b4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644295423, "uuid": "8d8a6aa9-61f0-4675-9fac-3635b0672d31", "value": "tmpqcjpsy64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cfbe660-88a1-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644298636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298636, "uuid": "0ee2dec0-27d0-48e5-be06-0fbc8e6c1d7e", "comment": "Malware payload (Loki)", "value": "23b8c542e9e37d3fca30202f6a4b4e97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298636, "uuid": "4490e7f6-5c3e-40c8-b03e-ca6e78efa527", "comment": "Malware payload (Loki)", "value": "33581705a7968699dc6ccb25decda4ade74191c4b1edd4363631e36d922f17be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298636, "uuid": "ba795325-c7a8-4591-b9f6-95749d28582d", "comment": "Malware payload (Loki)", "value": "d38e2e0fda5af72c7106316b2a631df9936f0e10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298636, "uuid": "3b789b23-e72a-44e0-9435-78a1c0e70ecd", "comment": "Malware payload (Loki)", "value": "16585e58eb78f336dfe1daa3095e565e3ec1e9b079a6812dc2528dcdbb44b0b454e297659f81abc4363157f2271b2735", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644298636, "uuid": "5bea79bd-29f9-4f04-8acc-3f928852e486", "value": "T110A4E043BF4E9B12C939A57668CBE8B643A65BF57733CB742CC8338C09523A15E05746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644298636, "uuid": "34353e95-0268-4c46-b7bb-531a6dfb1b75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644298636, "uuid": "d81f5166-4843-46ef-a730-4903589121d2", "value": "12288:HjBAmFah5g+xm5AeLaDAD6ZBKfMs5A/AZ++AeUnnj:Hd1FOeh5RaEenKfx58KU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644298636, "uuid": "ed2934d3-043a-42dc-aea0-4a1ce7aee14b", "value": 470528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644298636, "uuid": "d8cd494d-a7c0-416c-b79d-c71fa65969c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644298636, "uuid": "bdbf9e53-3932-4f41-98ca-af7aa30ccfae", "value": "AEO098372488.COM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad8d311-88fe-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644338549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338549, "uuid": "d0b15b15-f229-41c9-a05d-a3b6c7082dfc", "comment": "Malware payload (Heodo)", "value": "5d4ed870124731c5b9e5ddd2a377411d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338549, "uuid": "93830b14-2776-4214-b61b-7a3b604d0027", "comment": "Malware payload (Heodo)", "value": "33bd75c22567c7405a7eca4550b4d9205575381c0e7553431015140b93949051", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338549, "uuid": "558f9867-cff9-4c71-9f81-9c81c143003e", "comment": "Malware payload (Heodo)", "value": "073bec8fdf031e5ebbf4f83e27d6ca46c7ad474c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338549, "uuid": "95c8e61f-14dc-4889-88bb-3e4c0719c67b", "comment": "Malware payload (Heodo)", "value": "9d438bc5103ad656d1c955f6fd224c6962e9c5574c87e5ae6fce08a6e036f8a02dd8165a225f46485795f25337ef011e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338549, "uuid": "1e209aa1-e415-4262-8b5d-5b7a1b987347", "value": "T157C35A55F685EA1ADE0822350DDFC7F97336BC828E9A83473259B32F3D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338549, "uuid": "f2044bdf-b9f6-45af-b1b4-f517444c6365", "value": "3072:n/cKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dg+Bs:/cKoSsxzNDZLDZjlbR868O8KlVH37kex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644338549, "uuid": "85a3144e-798c-419a-8859-47aee44b99b6", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644338549, "uuid": "00166cf4-19d7-40ee-a933-8a70d254f0cd", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338549, "uuid": "1762bea6-e64a-45d6-ad98-8eebecbaad43", "value": "tmpi8brg2w2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d88cdcb9-8897-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644294629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294629, "uuid": "5b56bd94-82a4-41cc-afa5-c0be2e25e66d", "comment": "Malware payload (Heodo)", "value": "aa695588e3faf952d84f79787b4a568c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294629, "uuid": "b26da9ad-3879-4a73-a65c-42b921133e2f", "comment": "Malware payload (Heodo)", "value": "33e131ed67b6e57f0118b25a70a484e84e0fc19a8ce76e9dde07896724a7fce9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294629, "uuid": "b7162bfb-8f38-455a-a091-9bc098b8c1df", "comment": "Malware payload (Heodo)", "value": "022d561bcbd75200cadcb63cff5f4254983a5116", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294629, "uuid": "1c5cc7a2-9ac7-4595-a924-4d1de7d53d47", "comment": "Malware payload (Heodo)", "value": "952f146a52a863b5249756f32f739c787d74269ec779040bec006357c14e43122a3a8fafe1ff3c3b52ba9813c04272a3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294629, "uuid": "289d9aaa-41ce-437a-8895-cd5577052be5", "value": "T16F93E15D3E1C2907E1CBF138DF38EA9082244DE16692B8BA64707FB9503E497C16AE5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294629, "uuid": "44eda57b-5874-4c1a-a4db-b355b22386e6", "value": "1536:zZRkPTU36V1YfqvqKttqZ5Y0PSKa3Xm1WBXz7yL64i+kkfa+3gtfvjHtoxzg5bjn:zvk78e2iBtD0Ba3Xm4nC5X5gxvhoxzMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644294629, "uuid": "e324670a-c120-40d7-94bb-d02a38556b10", "value": 94231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644294629, "uuid": "cc0a2127-15fc-48c3-b082-af1a442bfdb1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294629, "uuid": "255d3c2a-5f38-4331-8015-91bc9d4adab7", "value": "tmpm4_hkpd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda7bf1c-889b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644296329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296329, "uuid": "70163f15-80a0-4596-a006-3d806c38702b", "comment": "Malware payload (Heodo)", "value": "45ea2f96715689b9f108ba80439347c3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296329, "uuid": "5844ff6a-6489-4039-92cc-8a0368a79951", "comment": "Malware payload (Heodo)", "value": "33f102170ca88e27954d9c3e58ea570f602589f6c1415606137e153c0b477bc1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296329, "uuid": "fc067ade-7e13-445f-a6b7-475e37e064a4", "comment": "Malware payload (Heodo)", "value": "176f0e09840ab5b8049ddd9a164f3a427b82b9c8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296329, "uuid": "4d42bc45-96f3-4af9-97dd-e1a61736fe18", "comment": "Malware payload (Heodo)", "value": "02a9cd34939d2738697f6310f944607e389b2577d2473c0b2be818f772e3cebe14a94e0498dc4dcc63816c419c1f0c2e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644296329, "uuid": "c487f13e-6d01-4f27-a0d3-d89a93286ff3", "value": "T18FD38D6ABA48CA0BD94913314EE7CBF67336BC819F5297473295B72F1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644296329, "uuid": "3a200a8a-5fd4-4217-b17c-19f88b9dd917", "value": "3072:lcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgDa35:lcKoSsxzNDZLDZjlbR868O8KlVH3ske0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644296329, "uuid": "daaee414-7146-4c46-9995-3f3a836a9f10", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644296329, "uuid": "06e07155-60c9-4b7f-9f7b-9b81ef7fdcd9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644296329, "uuid": "23d96832-159c-4b62-8cdb-5c714b04a118", "value": "tmplolplekk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f6eea5e-8912-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644347173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347173, "uuid": "faf47b9c-5d78-4830-ade5-f8e1adebb06b", "comment": "Malware payload (Heodo)", "value": "aad7334a99abdc0b08342c70b8ff2146", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347173, "uuid": "ac8bc0c0-d6f3-4b85-a63e-bdd8e76facd8", "comment": "Malware payload (Heodo)", "value": "34229a5940be43b677a161d97b785927dce8af83b343c6f7a78d42f9a3515c42", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347173, "uuid": "52ba7f37-d291-43d7-b57a-db43074f0fbc", "comment": "Malware payload (Heodo)", "value": "18d08c639bcf85def12623b25649d1147b5d6d65", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347173, "uuid": "a78dce93-ec17-421f-9dc2-cb2a10a920cc", "comment": "Malware payload (Heodo)", "value": "fa1832f4847eb3fa7016eb373149faa9fb823dce9b5df432c5503b817fe2b7145bc9810aed33feb3e8da42c4cc2f77f0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347173, "uuid": "e1b3e5ec-859d-4e6c-86ee-ff7ec963ad1e", "value": "T15B748C41E952C03CFEFB00B9D4D6C62AAD1E2E211B9D569F6244366C36603CF163F62E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347173, "uuid": "76ddd435-d564-4d0c-805c-a664c86eae69", "value": "79fb40281049052b3e354a6e444da473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347173, "uuid": "de85e296-4677-47dc-95b7-2820e1bf981b", "value": "6144:YFF10hIGpvueY+wBuBqtrgummwYT4ahREWkOieUR6:yKIG5zEnmGcKS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644347173, "uuid": "4d805cee-dfad-4b99-b331-67850e3b9f0f", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644347173, "uuid": "a129280c-8392-498f-91c2-a929b67f03d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347173, "uuid": "c43b6c64-d3d0-459b-812b-4ae8d9102ac9", "value": "emotet_exe_e5_34229a5940be43b677a161d97b785927dce8af83b343c6f7a78d42f9a3515c42_2022-02-08__190604.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b839661b-88fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644338384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338384, "uuid": "fafbc400-ac79-4e02-9f98-067e1491d5d5", "comment": "Malware payload (Heodo)", "value": "a0cfcac5b7df2fda2b35b7f557e6d4dd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338384, "uuid": "72cbddf4-2b45-40ab-bd6e-85541a8a585b", "comment": "Malware payload (Heodo)", "value": "345d775c2983de8793019f9bce7892a17286a64dbe940a80c8566a201a09b87c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338384, "uuid": "f5ce0915-86e0-46ef-b326-aac999b8b681", "comment": "Malware payload (Heodo)", "value": "0336435705b562c0be60c564e67389b01f98d991", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338384, "uuid": "75fc3113-01cd-4815-8098-af06294a19ea", "comment": "Malware payload (Heodo)", "value": "60d16f3adb68c86dc3ecb77c62669d7d2c5e4be936d5ae12cf78cddd5cf7ae277721ebf75867187edea6ea3f762b05b0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338384, "uuid": "0fcac9eb-1407-4f28-97cb-caf312e253a1", "value": "T1FCC35A55F685EA5ADE0822350DDFC7F9333ABC828E9683473299B32F7C76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338384, "uuid": "71903088-c346-4023-a160-a251c1fba39a", "value": "3072:yEcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLB4:BcKoSsxzNDZLDZjlbR868O8KlVH37ke0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644338384, "uuid": "ec90f443-3c3b-4771-976c-5e7e2f09e63a", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644338384, "uuid": "64c5c4d6-313a-4269-aafe-568bc53f1039", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338384, "uuid": "5bf68473-49b0-49c6-a9b1-2d9185a24674", "value": "tmpa5o1wmy2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c48bbd0-8914-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644347974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347974, "uuid": "f97c0af2-50e0-495c-a79d-c11e40605a15", "comment": "Malware payload (Heodo)", "value": "ed2b6de9dd53202650903ea093bb15b0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347974, "uuid": "8239fef9-7b52-4301-bf91-3595cdec2355", "comment": "Malware payload (Heodo)", "value": "34650f13254a8d100b5937e0676b961901573acd258721a7714039b236e50bb9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347974, "uuid": "08a78887-3c3b-4ce0-aed2-e7ca15ddab8d", "comment": "Malware payload (Heodo)", "value": "65f7001ec996f623603d929ce66feb0f640e15fa", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347974, "uuid": "c314c2fa-0a6f-40f1-8eb4-8c733b4d1d5e", "comment": "Malware payload (Heodo)", "value": "7c9d46580edc0e37e85c97dc8ec47442c838d3036c6baa86189300497457095afab604137e42dba12652fb89fe3630ad", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347974, "uuid": "020f66c8-7c14-40f3-8841-2c42f744d2b1", "value": "T196C35A55F685EA1ADE0822350DDFCBF97336BC828E9683473299B32F3D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347974, "uuid": "f1752cde-f405-4ed9-b9a3-d5b024f0cf31", "value": "3072:utcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgiBQ:ccKoSsxzNDZLDZjlbR868O8KlVH37keh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644347974, "uuid": "77c8d112-993e-46a2-92b0-63cfb0d89b1f", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644347974, "uuid": "1a306b15-b36b-4f8c-96eb-b57bfb61c70e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347974, "uuid": "cf88fe3a-f98f-4441-89a9-6ac22c8b56c4", "value": "tmpv0q9f8u9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77cb7eea-8903-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644340852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340852, "uuid": "ff3d9848-0660-4e3b-95cf-02e83ae0b8c8", "comment": "Malware payload (Heodo)", "value": "de8e9ed111e723089dadf852ad7164a6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340852, "uuid": "ba54b164-8c46-4821-8de0-7d3777908d76", "comment": "Malware payload (Heodo)", "value": "346e6f2035bb955b10af9a4294633ad4d8df232f46c027d0313dc6732ad23ce3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340852, "uuid": "9b7569d5-e3f7-4de4-8186-3fffd46053ba", "comment": "Malware payload (Heodo)", "value": "274296d149e3690203b616379f41121d80f7e287", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340852, "uuid": "d226fd39-bb24-4b3a-819e-87a4132843fb", "comment": "Malware payload (Heodo)", "value": "5c0dd8a16b2b07f57cdf705eea6e9c69c31ce549e59a2ba7f4895d5deaeec551092ef8c7b0f0ea2da494796ff2c07c1a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340852, "uuid": "a12d998b-17a5-4abd-adb2-2560a1084079", "value": "T1A3C35A55F685EA1ADE0822350DDFC7F93336BC828E9A83473299B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340852, "uuid": "fb1b19c4-dece-4f70-8499-0b05055ac859", "value": "3072:2XcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLB3:2cKoSsxzNDZLDZjlbR868O8KlVH37kej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644340852, "uuid": "ea21d6c2-de7a-4ae2-a162-46ad5e368f72", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644340852, "uuid": "fac29d48-d8af-48e1-8693-f548949436d5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340852, "uuid": "13b09822-c300-4177-9764-23d4bf0309fb", "value": "tmp31vrpu8p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f789b7f-88c7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644315122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315122, "uuid": "f205575a-8d23-4e24-93d8-3e4b748c6e6b", "comment": "Malware payload (Heodo)", "value": "dc27eda750e16d852fc4b922a979ab38", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315122, "uuid": "5f457b91-8ff1-48dd-b951-de537492d338", "comment": "Malware payload (Heodo)", "value": "3473af6b989200812ed18daba127faebf1801b9fe9774348f4d0610e441728dd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315122, "uuid": "2e934fd5-82c6-48d8-aacd-9b2878f5b5e7", "comment": "Malware payload (Heodo)", "value": "fed335eef7230b5caed0a08414507f85d81df402", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315122, "uuid": "fe4125bc-1589-4e77-82ac-3dd1a2753cbc", "comment": "Malware payload (Heodo)", "value": "cdaef3566d95a20dc514547e033044ee6385fbd5a980daeabf94811545eda4857ecd235626c615540ed8f6d84505b793", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644315122, "uuid": "f5327e47-ad19-4163-8de1-c449de5b437a", "value": "T19C93499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644315122, "uuid": "e79c551c-c2fd-466e-8f15-241229cd7205", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644315122, "uuid": "d0be38fa-3461-4dd0-9249-3d2469a58e0c", "value": 96926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644315122, "uuid": "a799357d-f1ec-4081-8e2d-526d6c6c537c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644315122, "uuid": "4aabc0b4-04e3-4f9a-a9e0-6648c1aa9b08", "value": "tmpgj896rvi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361b1ad5-88ab-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644302947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302947, "uuid": "dfe20f2e-b326-4b3f-b743-132260020d3d", "comment": "Malware payload (Heodo)", "value": "363b2451fff7bde7725921f9f9592ca1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302947, "uuid": "0fbf4675-2558-43d9-9c30-a20eda4128c6", "comment": "Malware payload (Heodo)", "value": "347c147a1d5bd604797b5f28cf4bd647a836bca0e8b0a52e2e59e0b0526b7b3a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302947, "uuid": "957f27b2-ad38-4929-9094-cf6a3788b390", "comment": "Malware payload (Heodo)", "value": "31dfb5290d4f110a2cf79fafdc1864706065ae04", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302947, "uuid": "78e8104d-4193-4773-a747-7ec1a56c4ef2", "comment": "Malware payload (Heodo)", "value": "7e85216b43fe1c93caf1cb46fec5e271d6ba737c3bec38245a068b68ba0c56dc5a1f1428c18500f5530bafb7d1d959ab", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302947, "uuid": "1e1a4153-04c4-44d9-84d3-b51ae06f7c2c", "value": "T12F93499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302947, "uuid": "2be2b8b2-ba37-4b40-95ed-f1cb67a061b9", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644302947, "uuid": "7fa8db27-b01a-45da-a6cf-892f903d7450", "value": 96626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644302947, "uuid": "2634d372-eeb9-4371-9306-42e2608628f5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302947, "uuid": "2bcb2b51-0feb-413b-bcbe-a63d217faebb", "value": "tmp4_80m4g9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ffbfed2-8935-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644362368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644362368, "uuid": "c8814ed5-b890-4d93-9f78-fb7d0f617650", "comment": "Malware payload", "value": "4653b1167fe6fd41f2c1c1c0d5a10d58", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644362368, "uuid": "e5b7d0eb-1f1a-4602-94f9-69e133deba18", "comment": "Malware payload", "value": "34a5d898f907b7a78e1918b0e1045c898c04ae6b479a3f925a4ed7593370ea89", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644362368, "uuid": "b3de7bc6-22c9-4b4b-8be2-2e0e953904bd", "comment": "Malware payload", "value": "7722f60854b9f0e73765316a6f7bbde0929c5fbb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644362368, "uuid": "c4837d87-2ed8-4068-8690-b185626f2852", "comment": "Malware payload", "value": "7dcc1e3ae725cfce1ab7e67df9576d170d74e12cf893b9cbd2d4dd1cdf72007f8569de1d03c040148f1d21d0dd5535d2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644362368, "uuid": "0528a60c-fc0c-4690-a88d-8dd844638cd7", "value": "T189C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B31F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644362368, "uuid": "d1ce4d1c-db1e-4c1a-8d3e-9b3ee7b2502d", "value": "3072:uScKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBS:/cKoSsxzNDZLDZjlbR868O8KlVH37keq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644362368, "uuid": "8ae789ce-6556-4787-9fc6-862fca0c0f5a", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644362368, "uuid": "c39ad5d9-9f5c-4815-b3a6-d0a24fd614b0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644362368, "uuid": "90aabdb0-a35a-45b4-bad3-98ea35525ee1", "value": "tmp005ng16u", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82dd328f-889a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644295774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295774, "uuid": "ee11bf3e-c2cd-4fc1-bd30-1d137da660fe", "comment": "Malware payload (Heodo)", "value": "2109bec3f312ad332a8e732fe6c8ab6d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295774, "uuid": "4e284dab-a6d2-46ee-ab40-7d4ea704608e", "comment": "Malware payload (Heodo)", "value": "34b31b2921a15d0a5936dbc3bf0b590bf207cae378f574a183a0f5cd0f8cb119", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295774, "uuid": "4016e2d5-97db-4cd1-af8a-488cead05b97", "comment": "Malware payload (Heodo)", "value": "b29a74c6700168b6d7cf2f22c098f8af93a682cb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644295774, "uuid": "38612b5f-29fc-466b-96e3-2e16b59d0a38", "comment": "Malware payload (Heodo)", "value": "9505052496f753f1017eefc97ff124c3563f5ac52066935b0dfb9b9172af92ee86100fbf8a4b1fea82063ce9a6ea97ba", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644295774, "uuid": "90937516-ddbe-4f72-90a1-50d32709cd9f", "value": "T1E9D38D6ABA48CA0BD94913314EE7CBF67336BC819F5297477295B72F1C3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644295774, "uuid": "0a64e107-5a66-4e6c-b26b-f3b818e9581c", "value": "3072:rcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3q:rcKoSsxzNDZLDZjlbR868O8KlVH3sken", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644295774, "uuid": "edd8e57c-1375-4491-af10-4a9c9406ecff", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644295774, "uuid": "e6d41c70-7e95-455c-9919-d257f9b7e2e4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644295774, "uuid": "f545ca84-0874-4541-bf37-cbcd7c716440", "value": "tmpk8n0l3op", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b24301-8922-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644354160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354160, "uuid": "b83828d4-89ac-4e95-b29a-9f6c41dd6198", "comment": "Malware payload (Heodo)", "value": "67c643ec3450f62bb0c3ba6b581ef4e1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354160, "uuid": "f5248c51-eafc-455b-9a29-219a2ea7d29c", "comment": "Malware payload (Heodo)", "value": "34b49fd6ad6ef13e7e109d29fc40f21f36f4e9f9a5b8ebb1694409240912a2c5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354160, "uuid": "087073c2-d64c-405e-baa9-554b9db6eef3", "comment": "Malware payload (Heodo)", "value": "94d0e90baad877f7bc0e73a59ccbb03855f04576", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354160, "uuid": "df8a2288-9ba7-4138-8674-9d92a1a70218", "comment": "Malware payload (Heodo)", "value": "d341e2947a7fe3e886c71fe2c836c158ace46571b1f3e4f215987280332d2dadb8611e8371b727a8c270d87996b6a4dd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644354160, "uuid": "0cc3434b-7d66-4827-9825-d3274a7cd7d6", "value": "T1A3C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7D76550CA12606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644354160, "uuid": "95aa773d-9611-4151-a84a-54f665c85840", "value": "3072:DGcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBo:ycKoSsxzNDZLDZjlbR868O8KlVH37kew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644354160, "uuid": "ba4e1c82-1e23-45ed-8824-4ba3c1292676", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644354160, "uuid": "4a19339e-ff26-4c62-a9bc-877349a1655e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644354160, "uuid": "b464f49d-039b-4ba0-b1a3-83e63ca4b266", "value": "tmp60too2k5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "108ba8f0-8910-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644346263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346263, "uuid": "f95ddb37-e29a-43cd-8aab-bb77aff7a9eb", "comment": "Malware payload", "value": "b023f67e7704b7208b41832882282001", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346263, "uuid": "3a4a2d7e-1563-40a9-8cab-05c3e54b8d0b", "comment": "Malware payload", "value": "34dfef94da4c0b42270045798534781b109a84399229db5150ac553805067695", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346263, "uuid": "aa61c37e-0119-4bfa-a43f-926ae6b93fa4", "comment": "Malware payload", "value": "7b277a3ea1701190285c63cabbf01e95d797515c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346263, "uuid": "d04814b0-e5db-4dff-8744-2a34a8baad97", "comment": "Malware payload", "value": "f907d6cf55bfada0f45fdc75a8d8b8da232ac19fd128adc1a869d4f877a5eae17b2d4c254450550705d6f44b27c72e92", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644346263, "uuid": "6dee2d99-ad1b-45b0-ad80-3942bb341192", "value": "T12FC48D2172DAC937C87B06B06E3AC79B55697D6047F2C4EB13C96E1E0DB25C05232FA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644346263, "uuid": "bb1e02fb-6e80-4336-86ed-16718f2c0d2c", "value": "6144:GWGc1dZY9nrDow+ZsrLg3bmfKlGzIqSqYf+SAO/VKEPM5TiyXdAnPN0:GWGofYBowv43bqKlRH1Vq9iyXdAPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644346263, "uuid": "8f051749-e296-4b18-a50d-ae153da67b9d", "value": 567296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644346263, "uuid": "23238359-ca5f-4fd3-9c2f-fef845675008", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644346263, "uuid": "6d0510f4-6eff-44db-b4cc-a3621f1e8c15", "value": "b023f67e7704b7208b41832882282001.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c053727-88f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644332726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644332726, "uuid": "84ce236c-d36b-4055-82db-86b0bd65b820", "comment": "Malware payload (Heodo)", "value": "9be35c2ba43c2cde5916776d6d052cc1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644332726, "uuid": "570225ed-153e-47ff-a6ee-639799210659", "comment": "Malware payload (Heodo)", "value": "34ec82288e7e5a83f2a09cf737757c45fd8162263e83352c2006fab907a9da12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644332726, "uuid": "245b4d74-d9df-43ef-884d-3882b6b04bf4", "comment": "Malware payload (Heodo)", "value": "54a70fcbb8544a311fa2f07c552e76597e49522a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644332726, "uuid": "eac8c91e-df9e-4c26-9c9f-c406c513daa7", "comment": "Malware payload (Heodo)", "value": "afe3eef8751eb50469c3921577cdc254f9f647941fa434b215d78a97eb5dc0851b85e3c0825966a78cf32fbc39a1f3d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644332726, "uuid": "a07ba046-3a8e-430d-a0f8-1343b7b17398", "value": "T1C3848D06E652C03CFEFB04B8D496CA66ED5E3A24169D619F63413A6D32613CF123F52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644332726, "uuid": "c7e1ed37-1a66-4179-b6d8-95ba59a4e0ec", "value": "79fb40281049052b3e354a6e444da473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644332726, "uuid": "d1de5e3b-45d7-4f5f-930a-26105d9aaef7", "value": "6144:O56dLjBFLyztOoJeYIjAmkB8lebi9JqGXdZ32mneM0laNUIbeURK46:YszuzNwjWB8f9JqQ2mnB0l4UMK46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644332726, "uuid": "b534aad8-7d62-4933-8302-30746e7215c4", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644332726, "uuid": "67fcf322-6b6a-4e12-abe1-a07d7a0e0f8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644332726, "uuid": "9da76fc5-d375-4999-be7b-74acb719df9f", "value": "9be35c2ba43c2cde5916776d6d052cc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b3f4ef6-8881-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1644285077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285077, "uuid": "df32279c-f176-45c0-a1e1-d1870ced9463", "comment": "Malware payload (njrat)", "value": "b52687cfa1cd78d0fbb93d39130f4d11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285077, "uuid": "a6f06fee-0f88-44e4-8fa1-dec83901ae63", "comment": "Malware payload (njrat)", "value": "35125b1dd360a1a6c3644dee373860f7e3c26660cb7cd8de4718b4ac8e4b4353", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285077, "uuid": "860b5c3d-862d-439f-a851-9c974dace51e", "comment": "Malware payload (njrat)", "value": "01b74ced167723d1dd222d6321e806a07f13d45a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285077, "uuid": "7a374d2f-5f49-48af-b992-082b4b110490", "comment": "Malware payload (njrat)", "value": "1ec06a45164f40ee4dfd0059a41067d824f493c44ed3e791ae9305c864e15b8f44ea3aff37b66a8851bd3242f0e4d026", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285077, "uuid": "496f4d8e-42a7-4916-9d37-378d547ed034", "value": "T1D9D4BEAC325575EFC81BC9329A687C60AA3170B787CBC2039117169C9E5DAABDF044F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285077, "uuid": "eb2425d7-f11a-47c2-95f2-91371af71f4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285077, "uuid": "7e5cc07a-0968-4c5f-a442-9beebcb817ee", "value": "12288:NUqkB075n5m3+cB+hXS5ja/1GEBxGui/Sm2MFSXVHTx:NsB25m3+0cXS5ja/PB4ui/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644285077, "uuid": "3dfa1dd8-7f37-47d4-98d7-2e405c6cd8d0", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644285077, "uuid": "4dc83ee3-5927-4c22-84a9-b1c5a4ef8405", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285077, "uuid": "6cd9abf8-a01a-4d60-896c-bfb824a4f9df", "value": "35125b1dd360a1a6c3644dee373860f7e3c26660cb7cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a686ffb-8910-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644346252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346252, "uuid": "5aaded4e-ec0b-4a96-8c27-01af4726a97a", "comment": "Malware payload", "value": "467e26f18e67fb5a381632b994a61026", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346252, "uuid": "871370e2-e7e1-4e68-ad2d-e6212261b264", "comment": "Malware payload", "value": "3567d6129326e5adb565d6ca854927491a5b2e232d374a38a7de9777a43d9bac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346252, "uuid": "ef52aca3-a3b6-429d-80a0-4506d16e07d6", "comment": "Malware payload", "value": "a102eab030e6cc7a674bb1eafe0a70d7f3f8da08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346252, "uuid": "320dd577-c4cb-48c4-8449-5ea3e08c96ca", "comment": "Malware payload", "value": "299df89df36df35c357449aabafe6a2d7ad08e5bcdf5ef09076edb92f2f7026de2f14a47fac66afa2c05b08b30ac4456", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644346252, "uuid": "ea139e79-8b7a-4aa9-9adb-1c1fe67ec68c", "value": "T116F5335AC771E3EAC16CBCBD02BCA7E67137B091895C779F428435ACC06426E192FA4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644346252, "uuid": "82593542-2714-4f3a-9102-ca635e7160bf", "value": "49152:cRnODNb6uKFmqlKhnlvjvujIM8cJhBMorc0+AE0MV0H7jNBX3yl:BDNuulqYruIM7JPj+AE6H7Rt3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644346252, "uuid": "7154657e-da7f-4771-8410-230c0f032115", "value": 3494121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644346252, "uuid": "8d33cb8e-26b6-445b-b31a-d7f1eb73ade3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644346252, "uuid": "efe3dd68-a835-4d30-bae9-1b68d8dbd17a", "value": "467e26f18e67fb5a381632b994a61026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "363ea6dd-892d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644358781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358781, "uuid": "9c11116f-dc63-4122-bb38-c14c2cf39525", "comment": "Malware payload", "value": "8836a5c0f2ff3cb29b500baa00005199", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358781, "uuid": "8a287ec9-b80d-4806-bb4e-552decfbdbc4", "comment": "Malware payload", "value": "35747d0268a52d8aa26b286d5c66ade630a08a04abf984847a1cc87f1bb29663", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358781, "uuid": "33356364-5fb0-4489-a466-0ae2cb7f98db", "comment": "Malware payload", "value": "86f2001d8678debe7922d31883b7e00a04dfa1a1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358781, "uuid": "798d0ca9-5539-4a6f-9c27-89dd59ee7874", "comment": "Malware payload", "value": "0041bdd060f4aa143c3608bee147d59b2c2719e79d7a1109b80b1ae4a665ac10716942071e53a60823ba4d092dd33da3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358781, "uuid": "21ad35c2-25e8-45fd-b3ca-7734142e4e6a", "value": "T1D0C44B13E68398F1C79C803973AD7BFF802A155547E876D30BF1858869AC0E14BB7D9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358781, "uuid": "d87ec9ed-b551-4259-b1b9-e7728f776979", "value": "1059dec3a72d4c311e39c8fc33d5af98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358781, "uuid": "60f02e2a-b0de-4cf4-af84-decd53908bb3", "value": "6144:/mbbvqXJery1jH9OttfeRdq9r8BVBALMaXEc9e8h2qYJVwdFmFlE/S:QbvqX4+eKdq18mLRXZeg2jJ0F9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644358781, "uuid": "e6350f1f-dbdf-4dcf-bfc0-592a7bbe330b", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644358781, "uuid": "ab0a2371-5e31-47fd-9fb8-29cdd9926a96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358781, "uuid": "ede8b978-cee4-4107-bc38-a099cd39d588", "value": "emotet_exe_e5_35747d0268a52d8aa26b286d5c66ade630a08a04abf984847a1cc87f1bb29663_2022-02-08__221928.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64184845-8881-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644284985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284985, "uuid": "524eb8c9-0744-4c4e-9e8a-487698404140", "comment": "Malware payload (Loki)", "value": "53438111ef43acb10552cab4859d8e97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284985, "uuid": "2c0941cf-f058-4e8c-acd7-e7a3bc386a37", "comment": "Malware payload (Loki)", "value": "35ab29f2d5e9a8c1f9601de00496dcd212d47f95d635d25cfca83b20d8e4545a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284985, "uuid": "6e2a3d1e-a3ea-48c8-800f-d988391098e3", "comment": "Malware payload (Loki)", "value": "886b1669cdb752b5ce889c37242ddfeccc80f338", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284985, "uuid": "aef0bb76-8909-44d4-999c-683ce3b28f3b", "comment": "Malware payload (Loki)", "value": "8cc910af1fea2096741b4074bb1d26d6b79f2edbe9b2d270c2d29e8c672de13b80957d0c52593f377434928957024dff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284985, "uuid": "e1445828-8154-4c15-8c60-6bd9845c8b57", "value": "T179D45BF5E56159A0DD9FAB345B32CD380F227EB9E475A02C24CD3D2B3BFA6920416067", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284985, "uuid": "83dc6e5d-f4cf-404b-9e2e-f638a1f33580", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284985, "uuid": "7b3c295b-b49c-4f0d-be4b-332ce7ea1466", "value": "12288:+FjApTYuJITshIxKUce8J/0OTP7r9r/+ppppppppppppppppppppppppppppp0G5:+FjA9FcOX1q5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644284985, "uuid": "1b8a7aa0-ea3a-45fa-8711-d7d1665f4f98", "value": 628224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644284985, "uuid": "dec65dcb-3159-4d87-8917-c0c61f8d320f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284985, "uuid": "7bf42dbb-ad1a-4e64-aae9-020b8b37b296", "value": "T\u00fcrkiye ?hracat\u00e7?lar Meclisi yeni belgesi ba?.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d536113-88ab-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644303012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303012, "uuid": "2642f84d-52a9-419d-91ce-e99126514115", "comment": "Malware payload (AgentTesla)", "value": "4a7008680cb07ed069fadf6b7f8149e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303012, "uuid": "0398e576-3f20-4cbd-b5e1-7a6b18014ef3", "comment": "Malware payload (AgentTesla)", "value": "35b883ea5a8fe89bda28becae430730a2033a1dc560a386a410d1be71d209f05", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303012, "uuid": "4530e890-9191-404b-9fbd-737e79423c6b", "comment": "Malware payload (AgentTesla)", "value": "bc113066316db7930e0a224bce0b835dc8de2acb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303012, "uuid": "760c22da-7ab1-45b7-baf6-e63fa9be1a0d", "comment": "Malware payload (AgentTesla)", "value": "b5c4b4003d387d924196a871ba3352cb9160dbd29ea839e7a3a0f28bbf5705f6e65ace42e6455ff79e570a43536c06a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303012, "uuid": "5d2af6d9-7fb1-41cd-b229-26b284fcfa5f", "value": "T13314122836CF804AE0184ABB0D1D83CF1827EDBF9FB96916E1293F356AB38D71575215", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303012, "uuid": "43a7c8ee-65d9-4d54-acdc-fc584ac9eba9", "value": "3072:H6k8WQgpZK9v2Gw0rt/3ppJ5OiTp3mg3loYwkZUPATdzM4/RmRuumRo59Tq2625a:mgKIGwq1Z755Tp3thZUP+NM4/2uu4oTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644303012, "uuid": "17b610e1-0f71-49b3-9091-46ed569b9ee6", "value": 191592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644303012, "uuid": "784b947d-99c8-4e70-b4cd-dfe25205e694", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303012, "uuid": "a942b991-416f-47d7-a0e3-bbb455e90bc3", "value": "shipping documenst 904428. customs INV.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ec7202-892a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644357623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644357623, "uuid": "06fd71f1-87db-4abc-91dc-5b3ac1273b76", "comment": "Malware payload", "value": "9e2e6ea53767003424ec6107f2bb76c8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644357623, "uuid": "66194416-5a6f-4953-87ee-9bbc7d2b8d12", "comment": "Malware payload", "value": "35cf625db843140215a72d3c8a52b9ffc61fe7b413c5eb755f8f6539854268fc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644357623, "uuid": "90670e0a-68df-4063-b5e0-914777417466", "comment": "Malware payload", "value": "b6bb79d89b31ddf5459dc5be646fb0f2530aefa6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644357623, "uuid": "400c3ded-c85a-4c90-b127-445a9214edf6", "comment": "Malware payload", "value": "7e07513708c67fc70665035d765c11144c286de132c2ba74add18bd6469eabcf37d13c6fbbbe51d95de2aef01dafb7e7", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644357623, "uuid": "7b80bad6-d50b-4893-bccc-7312b344986a", "value": "T19FC35A55F685EA1ADE0822350DDFC7F97336BC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644357623, "uuid": "ee7b0fbc-9fcb-4d52-9efd-a50c68b21fc8", "value": "3072:8kcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBy:HcKoSsxzNDZLDZjlbR868O8KlVH37kea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644357623, "uuid": "7bc8f8f9-2fc5-4b6d-97de-c50eabd341d0", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644357623, "uuid": "b164d270-884b-4e3d-a75f-212f8e646aaf", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644357623, "uuid": "c416dfff-8494-4d33-b60b-22f20e391977", "value": "tmpgaf0nutf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42440c9-889b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644296393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296393, "uuid": "a0eb0cdd-2e21-4075-b26f-8c9807a5cd54", "comment": "Malware payload (Heodo)", "value": "4947772b640d35700139841223b22f33", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296393, "uuid": "02a91a6d-bf7a-4875-a4c0-91cce07099b6", "comment": "Malware payload (Heodo)", "value": "35d759b5ebf06d433f3f2797302b053f8c7100f485d7c44f64211e5306306ed9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296393, "uuid": "bab5f67b-aa5e-42f8-865b-eba5ead250f0", "comment": "Malware payload (Heodo)", "value": "eca245aceda29b0164c98334a53ff18c5559dce2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296393, "uuid": "7837b2df-efff-4bba-8504-c89b7b81d741", "comment": "Malware payload (Heodo)", "value": "3cbdcc33d58a487c6a038a54059bbcadfccde15b3679af49f8e89813f6c92e1003bdc96190efa9f2fae062bead9dd8b2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644296393, "uuid": "7b99539b-22bd-4ad4-b85e-bac2902be74c", "value": "T1B6D38D6ABA48CA0BDA4913314EE7CBF67335BC819F5297477295B72F1C3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644296393, "uuid": "683efc69-6414-45a4-b82d-7e778fb92322", "value": "3072:IcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3A:IcKoSsxzNDZLDZjlbR868O8KlVH3sked", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644296393, "uuid": "5a8153c2-a301-4634-9c4a-b1e192d9fc63", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644296393, "uuid": "b855a8b8-2d31-4883-873f-2bb75af0d357", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644296393, "uuid": "a633f6ad-9539-4318-b2f4-a30c596f2a40", "value": "tmp_j01gftk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a18a67b-88c9-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644315892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315892, "uuid": "b24de268-2dc1-4e59-ba7e-e53feb9f06bc", "comment": "Malware payload (Loki)", "value": "5360b2d85692a82440be72506e62896c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315892, "uuid": "352d82b8-1267-4c33-b051-8c6084707832", "comment": "Malware payload (Loki)", "value": "3626c60d9b551c24ab20b5f50d9bfe90b3681c3a0953e45d41af6e44cc5ef6fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315892, "uuid": "a7b5ba6c-ecd1-4975-8930-c7a96eb07ff9", "comment": "Malware payload (Loki)", "value": "e91413361016135661f317c78a5001b02c061bc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315892, "uuid": "897b10a0-947b-44f3-994e-e80e8abc2195", "comment": "Malware payload (Loki)", "value": "9b8849494d8b7f7efa12e67fd7bbc670cb9ad054012f3e3780cc723403df1df8de9c77ca8491e0ebaf537177fd8b16d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644315892, "uuid": "3fd56406-7ea5-4666-b2d6-79fb3d693220", "value": "T151638C3A17BFF0F9D719A5B9E043E310226A6DA29F41515F33603A8E2C77A81CDED491", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644315892, "uuid": "85eb949e-ba53-4c9d-8301-9582551885f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644315892, "uuid": "5b0090b7-9b99-4bb7-abd7-6ed403ccc9cd", "value": "1536:vmaB6JbLpWfHJ0cYeWQzPhOvVihneW9+T:vmaB6JbcR0wz5OdRSg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644315892, "uuid": "309862be-7fff-4ce3-8eb5-143e2df2b9db", "value": 71168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644315892, "uuid": "1ac7c1c6-95f9-4309-ac6b-d57e6f4909c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644315892, "uuid": "b373c1a8-3bbf-458c-ac2c-42d63b88dd18", "value": "Gvjkhkjin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec296395-889c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644296810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296810, "uuid": "28712524-7cd7-484c-9077-b003cbb3482a", "comment": "Malware payload (Heodo)", "value": "7d934df25e166725c85e982a525594ae", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296810, "uuid": "55de7ba3-9376-48d6-90a2-5958c3379100", "comment": "Malware payload (Heodo)", "value": "362f1fa72860b8646bf8e084de3e6358fa18ed5bb0150877f55fa74f4ab861c8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296810, "uuid": "add64fc3-caaa-4211-8dca-a85c8b7ec3c0", "comment": "Malware payload (Heodo)", "value": "ddab18319918749e186ea67f9a0b161b5f7c877f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296810, "uuid": "e83eb3b9-71fb-45b4-a70e-da923bacc8e5", "comment": "Malware payload (Heodo)", "value": "c9c0ca8b66f3fd70e233859adab940e1213a43974c08c6f8eebb7ceaf732cd5ccc8a6a9097f250b746737de0903d558e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644296810, "uuid": "dda24717-c304-4b80-adc3-5b3fe944375e", "value": "T15DD38D6AB648CA0BD94913314EE7CBF67336BC819F5297473295B72F1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644296810, "uuid": "915e4732-f57e-45a8-b840-0661bcbe79c3", "value": "3072:8cKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa37:8cKoSsxzNDZLDZjlbR868O8KlVH3ske+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644296810, "uuid": "dda17381-37ae-4788-9f9f-e596e2316e3e", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644296810, "uuid": "065071cd-9a6d-4501-8950-b4d1d05fb4ff", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644296810, "uuid": "79165fa0-1233-4f83-acb6-96c2b1ed6704", "value": "tmpetmp_04p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482fdf83-88d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644321875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321875, "uuid": "49ef2e6c-cbb0-4788-ba3f-0d0f898d37f8", "comment": "Malware payload (Heodo)", "value": "66c060026395de6915c8741061567670", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321875, "uuid": "ba4da371-89e7-4449-af7e-9985483c1b85", "comment": "Malware payload (Heodo)", "value": "36372dab8bfbecc3d8b6b1f08ffc17a4cc105e34816965f8ffeb0511e760672f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321875, "uuid": "2042a149-af72-48f4-8be8-29c722dfc1f8", "comment": "Malware payload (Heodo)", "value": "8a1d0f08eaf1ff552d71082bed5a8324dce6b137", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321875, "uuid": "e613879f-8b27-45de-865f-f274c2ec66d3", "comment": "Malware payload (Heodo)", "value": "77e08a465193b21554761820680ed585d5b301c46c9fe43817b476253c3e4aa7f47ff8882abcaf666e3742cd1b699c59", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644321875, "uuid": "0ebae016-3846-4acc-9b64-1415953b5519", "value": "T13AC36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644321875, "uuid": "b381df55-788c-473e-8159-e5e1a1370b5a", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644321875, "uuid": "83e22c40-5202-44b9-9e71-ce0b7034a304", "value": 128089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644321875, "uuid": "4f854250-028c-43bd-b783-085dfd9d8b0a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644321875, "uuid": "477a1390-d1a0-41df-ad95-265cc486c547", "value": "tmpaq2eckoi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b251105-892e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644359273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644359273, "uuid": "cab8d50e-6cac-41af-ae0e-6051c36e8e8f", "comment": "Malware payload", "value": "52f62096e0e4e96bbfd8d0c4d44a635d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644359273, "uuid": "c9c8da65-8678-4815-873e-7c2712fd01ef", "comment": "Malware payload", "value": "3641ea902183138b7898a659465214332428b1913c1b16d891a8ded9b348553d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644359273, "uuid": "6e42a4fd-b09b-4dcb-9f4a-9b3e9e0d5502", "comment": "Malware payload", "value": "d93799bb9abcc4311366db942131c342ba1f0c07", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644359273, "uuid": "e7653a8d-88f4-4450-87d0-ae4fd6c5e0ce", "comment": "Malware payload", "value": "3b868cc263487a5ca5b445b47fbf957faee1d8b93a7962cea3c43b189f26b9c85ae5bd2831fd1acec1fa504d5bc1a8be", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644359273, "uuid": "4fc4405f-2f29-46a1-9477-490dfed1813c", "value": "T119C35A55F685EA1ADA0823350DDFC7F9333ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644359273, "uuid": "3f0700c3-8d58-440e-b93b-f3d4d237d2b9", "value": "3072:sOcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLB3:NcKoSsxzNDZLDZjlbR868O8KlVH37ker", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644359273, "uuid": "f193f35e-4d74-4eb4-b597-419bd0a2f93d", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644359273, "uuid": "42855bb7-dd98-48bb-b7b5-dfb63ed4aa6a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644359273, "uuid": "e5bcfac0-0825-42c3-bf16-c1a1dc4f9772", "value": "tmpcm3a68mq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f295978-88ab-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1644303042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303042, "uuid": "f5359d2a-1922-4cd7-b341-30cba0160890", "comment": "Malware payload (GuLoader)", "value": "b38e09e55a6078d2d80bd5ad4aaf07ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303042, "uuid": "e847af86-ff2f-4bb0-adf6-84bb2ec59382", "comment": "Malware payload (GuLoader)", "value": "364f31cc07c59f4151b5b8185981f3b1275c84352ff782068ca3a79dc8a44dd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303042, "uuid": "58a62521-437d-4d22-b652-7b07fcb09b1f", "comment": "Malware payload (GuLoader)", "value": "d2687e6fc806e63a38f8ea646b42f5b36dace28b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644303042, "uuid": "ee235138-9a4b-4ec6-9d59-23332a549722", "comment": "Malware payload (GuLoader)", "value": "3cc07ecb9ce18f01320a1ea444dcc39735241be24d8b1b092cf40f9b149e4e3b33f15470b0ee9e6314ce929dddc877b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303042, "uuid": "79d03953-f975-459c-9bd0-e3e12789c99d", "value": "T18A54D091B020CC6BF91BA230DE6355F16451CD26E6A887BF21553E586BB37807B3C72E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303042, "uuid": "1fc2885f-e367-4707-930c-fd5c3f6d08fc", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303042, "uuid": "bba05748-ce3d-44b8-aeac-6c9d3a6d867f", "value": "6144:IbE/HUUUvrUMblDg4VrILfhBkAG6t5uSIwUP0mCz3DH0mzcmNJtd:IbIUTDlDRrILy/DwMqTDH0mzcmNV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644303042, "uuid": "69a37400-cba5-4053-83b8-c607fdd84bdd", "value": 300296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644303042, "uuid": "56d448f2-cceb-4aef-8895-01f0ade7eba5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644303042, "uuid": "75d12354-0ed2-46c0-a7da-13a446073b5e", "value": "CEMP SRL 02072022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "120d896e-88b8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644308469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308469, "uuid": "14deac8d-3d18-47d0-8f77-4f1916449457", "comment": "Malware payload (Heodo)", "value": "f66eba518233c6b68e46b7a8fea0add2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308469, "uuid": "5b7ba11e-34fc-4e37-b4a6-a1b65ce13d02", "comment": "Malware payload (Heodo)", "value": "36c78483cbceb60f82e45665c01a585973a29589ae800748c407ae77a7027b6e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308469, "uuid": "32176ce2-5c9e-432c-9727-7fe725a9db4b", "comment": "Malware payload (Heodo)", "value": "05e3dbff1b531d74d3ead4541211389c7391d018", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308469, "uuid": "7c4c8a64-87b1-4e14-820c-9c338b90685d", "comment": "Malware payload (Heodo)", "value": "2e475bfc6a0a6e6b729a84038e975c4144439ed1ce21b75ad333d6f85497e98feb04c69274cde1520d6a1fa503fd1e18", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308469, "uuid": "68f302f4-eb6c-4dcc-acae-24ecd6699740", "value": "T1FD93499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308469, "uuid": "6fee0440-5140-417b-baa2-1478f3a9e8ad", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644308469, "uuid": "b7f4dbfc-0bb8-43da-86d8-b2e8c517ab65", "value": 97322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644308469, "uuid": "6de3b8ac-bef4-4e53-948d-aab99cb42c2d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308469, "uuid": "acb2c809-739f-4afd-a3eb-e3ba9750de03", "value": "tmpedo9ltnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59879b7a-88d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644321474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321474, "uuid": "eb9853b0-4b9b-47bd-8638-0a0a8ea7062a", "comment": "Malware payload (Heodo)", "value": "78b2d06eeade2c895155b80630ae14c6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321474, "uuid": "62e15c14-83fb-45ba-8b20-d4c625a8b762", "comment": "Malware payload (Heodo)", "value": "371f5d95d0c2128a9c115ec00b3acfb30e7e5b502fd279b099795e9d69e719a0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321474, "uuid": "fafe5530-50a6-4679-a5dc-4a7a7b064a80", "comment": "Malware payload (Heodo)", "value": "ee0ef78a586f2844476b9663463c9ccdb50063da", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321474, "uuid": "f52704ee-5689-40b0-8a25-bf9cea45a24f", "comment": "Malware payload (Heodo)", "value": "e365b5b8eb4f2127f894222bf22a0d013625d5a76f3582a2e5dd085e0f8eb8174ba66b4622785f9bef9bf852ddc831c6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644321474, "uuid": "297bb10c-9944-4d98-9451-8ed11e3d5501", "value": "T1D8C36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644321474, "uuid": "e8b399b1-1674-4000-9236-fa56adeae562", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644321474, "uuid": "60f8b25d-1a35-4f3a-b1c8-dec26a1230a5", "value": 128539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644321474, "uuid": "5f20fabf-9782-4c94-a44f-7f20a7f2c153", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644321474, "uuid": "319493d0-6975-4382-89a5-2833d78953ce", "value": "tmpdyvuhkq2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09268c2-88f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644334049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334049, "uuid": "2fc0fcff-3e8d-4be8-ab00-460671314b5b", "comment": "Malware payload (Heodo)", "value": "0bac62002e8f58e8e9d553b83b1a05df", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334049, "uuid": "9119f826-2147-4da2-9dca-8536d87ae8cc", "comment": "Malware payload (Heodo)", "value": "375c87b258ac5ec0f65255d2c8505fbe19c044e01fa1bcdb7cfa7b1e8e942f05", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334049, "uuid": "b5dbc284-47fc-42a9-a580-7c8f67adf5bf", "comment": "Malware payload (Heodo)", "value": "011af4de41f538d6cc0f864890b3b856f7be89fb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334049, "uuid": "46391341-7d41-4b87-be80-63d713b9b841", "comment": "Malware payload (Heodo)", "value": "0d0a0e1682940f10acd00579bf8ebf30589020cd97879d2b5f74368ebf7641066838718c155a892080e846e07eb7ece5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334049, "uuid": "6e1e4402-b455-447d-afd1-0d9ef4a02816", "value": "T159C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473299B32F3D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334049, "uuid": "10656d03-d527-4cf5-b771-9e9aa20661b8", "value": "3072:zjcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dg+B9:vcKoSsxzNDZLDZjlbR868O8KlVH37ke4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644334049, "uuid": "34de7654-e819-462c-afa9-c7c0446eba0d", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644334049, "uuid": "1ea2cedf-d245-4b92-8958-543c8e9ac728", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334049, "uuid": "8233a31d-b228-485a-92e2-bb9b5c611a47", "value": "tmpqb0yll57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccaeb2a2-8878-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644281295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281295, "uuid": "d5f7e729-e1e1-4ed7-ae8b-17f6bce939ab", "comment": "Malware payload (Mirai)", "value": "a3e792ff8a80ead3f2a45003279bdf05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281295, "uuid": "a332f238-0902-489b-9681-278dea782885", "comment": "Malware payload (Mirai)", "value": "377dd396b44abe0976c0f781125e30390dc7e0f70baf2efaf5058010b2c02d96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281295, "uuid": "b86014b0-6eff-4598-bd49-7c44fc6ef878", "comment": "Malware payload (Mirai)", "value": "f3f8f5c900c77d21e1e6404e54c9050c9f9ddbf7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281295, "uuid": "c4070124-ea23-4169-9425-521500227b22", "comment": "Malware payload (Mirai)", "value": "cd6ef8860ec710b00edb214a3dee77a6fab5e2c81c173b0d78f9a92658e90d7a38b2b413f84abc894d7e25dd8fcec6e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644281295, "uuid": "64cb41ff-8203-4c6f-a6cb-ad5a45cf9c10", "value": "T1BE334B52F8925A3AC5C013BABB6E6A4C372163E4C3CF3213C8642B657ECA51F5D67E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644281295, "uuid": "7386fc85-3115-4ec0-a874-71774b925f91", "value": "1536:9G52n05L0+wgx65NRY3g3JDGWk9L5W6ia10e:I2n0AwEW3UJDB8L5Wa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644281295, "uuid": "28602683-88fb-461c-af29-497c742377d6", "value": 51984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644281295, "uuid": "83165e14-5a88-4ef4-ac43-e4328ef9e2f4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644281295, "uuid": "aefee8e1-0331-4d2b-8e15-8efc25ac0dfb", "value": "a3e792ff8a80ead3f2a45003279bdf05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f321b50-8915-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644348462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348462, "uuid": "ea2bcc28-5693-48b6-875f-202956357501", "comment": "Malware payload (Heodo)", "value": "6e413995b035fa7f3f6f7ad2a64999ce", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348462, "uuid": "0210ebab-403c-4ba9-80f4-872478da6f2e", "comment": "Malware payload (Heodo)", "value": "3788d667bc950932cf4ce95915ff71879f28132040f72d939352b18ca8e7a492", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348462, "uuid": "6d243a93-5e37-4652-b1a3-83d51baa449e", "comment": "Malware payload (Heodo)", "value": "57f3f866ae01adaf7c1acb21d2244d8cbf4b58d6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348462, "uuid": "09a4afb2-0d9d-42fc-b60b-1abc96590c08", "comment": "Malware payload (Heodo)", "value": "6a694f509716d448491c9f5e144250dd689cac1387cf55be330bd56b4afae7b6f0e9576d1393606b839417a7ae9cf576", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644348462, "uuid": "159b6b8a-cf27-4d93-87a1-b088af1b607c", "value": "T106C35A55F685EA1ADE0812350DDFCBF9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644348462, "uuid": "e2916518-b85c-4238-9f27-530b6cd57962", "value": "3072:SBcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBG:scKoSsxzNDZLDZjlbR868O8KlVH37ke6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644348462, "uuid": "967fe4d4-15f6-470d-adf3-f4ef61240cbb", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644348462, "uuid": "b3830666-14f4-436b-833a-874b37f6b261", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644348462, "uuid": "9c5bb9d4-e2ce-405f-98ec-228a450ae7c2", "value": "tmpzq4vkd9p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad40ea06-8893-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644292838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644292838, "uuid": "17f00bbf-7563-4447-b719-d51a2d5a374f", "comment": "Malware payload (Heodo)", "value": "b2ccb797fefce6b20b3de6f5072c4a77", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644292838, "uuid": "6f70ae21-1e6b-4dec-b27a-5251ca00babe", "comment": "Malware payload (Heodo)", "value": "37a04a7de713255822aa15fecefa1654f4e43178a2628e1b76f5aeb21d22ec3f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644292838, "uuid": "2d505030-8c9f-4544-9fe5-252130ca3c5b", "comment": "Malware payload (Heodo)", "value": "e19c5efb4e3662d7afda2dcad0048b01143c032e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644292838, "uuid": "21e10acc-54e0-4847-81ca-723dc5eee7ee", "comment": "Malware payload (Heodo)", "value": "5448f2f7477f901e8eefc98bdbaec6f2d02dad5573e42ac9d1c3decbcc953a096f9a6191ff6a9e334a08c4d89731558b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644292838, "uuid": "faed1f13-ec58-4bad-beff-7eaa834310a3", "value": "T1FDD38D6ABA48CA0BD94913314EE7CBF67335BC819F5297473295B72F2D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644292838, "uuid": "2b7c9444-4cec-4bbf-8814-918a11f2e5d4", "value": "3072:GcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3d:GcKoSsxzNDZLDZjlbR868O8KlVH3skek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644292838, "uuid": "e6d4e8f3-46a9-4f18-9f70-a5b966572f31", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644292838, "uuid": "a2b2b02e-e7bc-491d-b51d-33bb3e3f36e1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644292838, "uuid": "f16b8d29-e83f-48ee-8ab5-d8604bc10ad2", "value": "tmpuwnjtyhr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ead7af0-88bf-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644311551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311551, "uuid": "a069ae11-bcd9-4017-af96-bfdb519ce6c9", "comment": "Malware payload (Loki)", "value": "8c11c1699daabb8e57a450d8d6b8dc5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311551, "uuid": "a1facada-2f35-4d60-bc43-f9e9b588d0bd", "comment": "Malware payload (Loki)", "value": "37abfa331d62655654f577dc525a697c7bb75be9128067a83d88ef55e0bb66bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311551, "uuid": "39c87a2f-976f-45a9-9ac4-981b6e3bbfc9", "comment": "Malware payload (Loki)", "value": "6aac6eb7e2cea79ff9691722d21924d5ce296759", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311551, "uuid": "5915827d-f447-49e6-9c59-9d49140f4b10", "comment": "Malware payload (Loki)", "value": "b272cb21959773b6e14409fd3a3a3f2c670bdeb2bd9856e5caa7af5ad71f3da68348b23d58ab33a00143a59bca682fc2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311551, "uuid": "5b73a84c-4ea3-49c8-9052-ffa5e9e18e0f", "value": "T1F934125A8CC799F7E0210E7406352FABF2FFC7940696856F8B541F7E2B541832C0B9A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311551, "uuid": "f05eab82-0481-4f92-916d-755a9d33c484", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311551, "uuid": "6a49cc7a-871f-493a-8995-4c385997fe63", "value": "3072:oNyah0mJo2mNTH3x30Jv5HdOIDkD+DkzDnjxfHphqRJCLeKCbv8/SVal9i:ow60H3x30JhHYgFenVfJ4RoLeKCgX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644311551, "uuid": "ccb09ed1-3509-45cb-b796-d008f50b7f88", "value": 236491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644311551, "uuid": "65141da2-a974-431d-a16e-50ff82b76871", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311551, "uuid": "bb33e1c5-df41-44fb-8885-16f9c5663baa", "value": "8c11c1699daabb8e57a450d8d6b8dc5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e19c79ce-88bd-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644310965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310965, "uuid": "ac26e13d-d908-441c-8398-d223a5fe53c9", "comment": "Malware payload (AgentTesla)", "value": "b3a27137bfa9f92fe6b4cc7f0aaf08f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310965, "uuid": "9b91590d-41ad-4649-adc6-de9cfc175403", "comment": "Malware payload (AgentTesla)", "value": "37c712662321d51383b50cc3973ba187706384859c6ff4f9e43e8be3c9e6dfe4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310965, "uuid": "46af84c1-b534-4557-876e-2c48eabc8c60", "comment": "Malware payload (AgentTesla)", "value": "266e5d674bd1fe6135bd74658bb8a1d58777bbe0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310965, "uuid": "a209b018-f5ca-4230-9114-75a63d50cc76", "comment": "Malware payload (AgentTesla)", "value": "2c5b52628ad072b3bd6cfc44f75934f86e8c41a0f54a980ccaffe6b049bbbf41213291be22a3e5ffcb6ba37c2a307247", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310965, "uuid": "4b63cf23-27e0-43fc-a7f7-b82627d860d9", "value": "T1BAD49C3F89BE113AC2BCCB719890CE1FF426D5523977692D2A9625D904233F275C622F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310965, "uuid": "5c46321a-7c8b-4b79-98cf-00cbe9c139fe", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310965, "uuid": "6cb32010-a219-4724-a81b-b810c5ead845", "value": "12288:7Tcqddk/mUs1fjtQUVPcVqpYg6yCkG+NjcoG:TEzujKg9aoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644310965, "uuid": "b8d7d610-c9cb-4a4b-b571-31bf2af6e1fd", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644310965, "uuid": "27038a89-e2f7-4123-bb00-ff7ca9f59cb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310965, "uuid": "718198b4-6f07-429d-babf-1c2e36ee55e9", "value": "b3a27137bfa9f92fe6b4cc7f0aaf08f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2cac125-88c5-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1644314296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644314296, "uuid": "6ed4e1f3-4fb5-46bb-990a-a2aaf54f7595", "comment": "Malware payload (RemcosRAT)", "value": "053aea1ba61d5e6f5bc55c63761086e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644314296, "uuid": "368293b7-4172-4b8e-ae0a-a33b1cf79fb5", "comment": "Malware payload (RemcosRAT)", "value": "37c7e817c4e65f4737e54b6f0801be11682cbcccab5e7bdd7d75deee904866cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644314296, "uuid": "92b69391-3e16-4586-933b-3597a5c3bd4c", "comment": "Malware payload (RemcosRAT)", "value": "493b890eb72aba7fdc3e9279fc4495be7ca9d71f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644314296, "uuid": "39bb4854-e739-408d-afaa-56696ebf39a9", "comment": "Malware payload (RemcosRAT)", "value": "afd065d41c15e956b06c41dd98b2fdc6b300e789059958d170db52cf6eee2d9c16392d502c5040f56be85d66fde1d415", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644314296, "uuid": "b099baa5-b40c-46e8-9268-cb067cd52d24", "value": "T1D405F52C7B636F6AEE4D817045030B68FF2E0E9362C0D9B6579B29C4A74E0F51D4789B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644314296, "uuid": "8f388067-bdff-444c-a6a7-a6b89b4bed15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644314296, "uuid": "b6a03ed1-ef23-4aa1-82dc-03fd0ee76363", "value": "24576:r45ICgtiCLO+9KbwFVuI/G06MCqurzhvB:r4G5dLO+9Kbw/uI/GyJkvB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644314296, "uuid": "c311146e-bc75-482f-b89d-946fad2cf841", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644314296, "uuid": "8f4c3a7e-029b-4df2-a444-425f737e117f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644314296, "uuid": "933dd7c6-3883-4d1d-b928-bb5753b3a9ec", "value": "RECEIPT-IMG303948485.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cdf624a-88f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644335546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644335546, "uuid": "2a7777d9-e073-443e-939b-0af86d33b2de", "comment": "Malware payload (Heodo)", "value": "f999068258c03b100824424ba1db79e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644335546, "uuid": "da0fc7d0-6ad2-4a79-a459-f2965fa72961", "comment": "Malware payload (Heodo)", "value": "37f8098e5e79bc8b50bd11d24060be75d9da24d30e96a9686788b901530f53d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644335546, "uuid": "8eb474bd-5eb3-42b5-901b-32bbdae08b96", "comment": "Malware payload (Heodo)", "value": "4f9b620cff9a9d281b88ef5506a44a6ab990cb8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644335546, "uuid": "4e81349e-90d5-46f6-9077-4ccf21fb0381", "comment": "Malware payload (Heodo)", "value": "70ec7640a0740aaf5cb4e85bab02177d3825d2f451576c99751b3f41cc68ea51b17a5ca8c74218af55060103db6c8581", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644335546, "uuid": "193cd7b4-3588-4c44-b31a-6e4b65ddc76b", "value": "T102848D06E652C03CFEFB04B8D496CA66ED5E3A24169D619F63413A6D32613CF123F52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644335546, "uuid": "dc3e3967-e8de-4f86-92e0-05040fd83387", "value": "79fb40281049052b3e354a6e444da473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644335546, "uuid": "c8b78b8f-de93-4e82-b0f8-4c728fbfeb0f", "value": "6144:O56dLjBFLyztOoheYIjAmkB8lebi9JqGXdZ32mneM0laNUIbeURK46:YszuzNIjWB8f9JqQ2mnB0l4UMK46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644335546, "uuid": "c500630d-7d97-4d43-a806-b2fe6247aa24", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644335546, "uuid": "ec0313e8-b1ad-459a-a3c9-a6961ddca174", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644335546, "uuid": "ab184315-4c82-4644-a8de-71775bc1e0df", "value": "f999068258c03b100824424ba1db79e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a4cab47-88b4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644306873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306873, "uuid": "0ab0e03b-f9fd-4498-a4da-5578b3c53638", "comment": "Malware payload (Heodo)", "value": "22581bf72fc65a5671e37bb28b654bea", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306873, "uuid": "94bd669c-412e-43c0-8920-ba0ddd7ccd4c", "comment": "Malware payload (Heodo)", "value": "3804b3c510c0961355c2804647e95bf82cdb86a4750bca7d553fd9edcfadbe90", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306873, "uuid": "efe2b6e8-96db-4ee2-aa26-97ac74c8fc17", "comment": "Malware payload (Heodo)", "value": "f74243bb0893363539224f6a23b13e1c18e68b48", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306873, "uuid": "575c2766-deb6-477a-ac28-d63c5e5908f6", "comment": "Malware payload (Heodo)", "value": "2f840c6888d5d5cf551b0524b006630e33afbd75e5c72c751d0b52c9e67df8e81c62ff0f9f1dbd7e46c4369ad9a9a0d2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644306873, "uuid": "0f45f9da-653c-4ec9-8d7d-7376fb1099c4", "value": "T16993499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644306873, "uuid": "256bf3ed-04af-4964-b476-60d402689eda", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644306873, "uuid": "716b92d7-2c05-4c05-a5cf-0741b47f82ea", "value": 97081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644306873, "uuid": "ee40141b-0ded-4a63-87c1-e8c7a4a793d2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644306873, "uuid": "88451c6e-6565-4bd5-9a46-6163699f6b75", "value": "tmpizanjg_p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "265da8c0-8897-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644294330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294330, "uuid": "551b1072-af4f-4e06-897f-8e948f8b2806", "comment": "Malware payload (Heodo)", "value": "afefbb3044377711666c03ec7d7753ca", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294330, "uuid": "28912a42-701c-476e-bee4-838729e2f4f3", "comment": "Malware payload (Heodo)", "value": "3852328ea3e13c52670b96e0888a5f6e2f7f7bfbec8fad11954e90c9a3bba64e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294330, "uuid": "885db469-fb77-4efb-8cc5-15091bcbd886", "comment": "Malware payload (Heodo)", "value": "e872062de262172f9b9af97a663667f992679818", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294330, "uuid": "a7bc1f52-7afb-4eea-a424-5c17af44aeb3", "comment": "Malware payload (Heodo)", "value": "677c9fddb5eda9c2f59335a3a1caf38f1a4bb77947f44fa535ea774cfc002258dc3a0b074aa4849637cfdba77803be27", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294330, "uuid": "fe977cdf-32e4-4941-a513-5ff630f7061b", "value": "T1E593E15E2E5C3E07E1DBE134DF38EA6083651DE062A3B4BA64A13F6D503D493C166E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294330, "uuid": "931a2d0d-08aa-43f7-9ef3-c58ff4c83ef5", "value": "1536:zZRkPTN/3ufvgN0YlVkSKa3Xm1WBXz7yL64i+kkfa+3gtfvjHtoxzg5bjIFnB:zvk7NfuXgeY8a3Xm4nC5X5gxvhoxzMIT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644294330, "uuid": "bcba89a2-d79e-475a-8de0-d0bdbc514e84", "value": 94226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644294330, "uuid": "9ac55c8f-5236-441b-88ec-5217fae96e3d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294330, "uuid": "d647c730-623d-4c2a-a4c0-7f278318f674", "value": "tmpxp22mthu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d73488-892c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644358485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358485, "uuid": "956f41c6-e095-4732-bb65-fc9536c47ab8", "comment": "Malware payload", "value": "ba4d7a2c57a8ae5c6494364b7fe4343c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358485, "uuid": "21beede9-77bd-421e-9056-c60823cac89c", "comment": "Malware payload", "value": "38d0933fcd5b1ba977d598cc9adcd004a00092e39d09b74bff25e524b9d1eb5a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358485, "uuid": "f6f75ece-0787-45c1-8cb5-ec6f4148a9f9", "comment": "Malware payload", "value": "806c77089a4e8b8c2421662629f50672b0e5db02", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358485, "uuid": "abcd19a4-f1fc-41aa-be8f-bcd8572cd49a", "comment": "Malware payload", "value": "88ac350f416d1ae271bbe24c4447001beb62a609b206996ea7cd8215819755d8dd2ba4bbf6877d6da5feb32faebb2030", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358485, "uuid": "f92669a3-a33b-4ab5-b0cf-84d88bece923", "value": "T1D2C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358485, "uuid": "9c542817-73ff-4bea-90e8-0345ea9e2af9", "value": "3072:qtcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBQ:UcKoSsxzNDZLDZjlbR868O8KlVH37keI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644358485, "uuid": "e8c632f6-c28c-404e-8ce5-e5d1e8970876", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644358485, "uuid": "3d5ba52b-8285-455e-b9bb-9291d69e3cd9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358485, "uuid": "c98479f7-3b24-43ff-9a46-b3e1166d82a5", "value": "tmp7d4g3ev8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ace4beb-892f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644359567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644359567, "uuid": "64373568-a753-4a3a-93bf-07eb472846d1", "comment": "Malware payload", "value": "c2249ee0dadf963e67da316017ca7565", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644359567, "uuid": "9bb4884d-f1f4-4654-b9ab-5648cbcbf8b1", "comment": "Malware payload", "value": "38ec5fbf3f016121e2fe3786f80c8ef4233b0393616d2791584cbafb32823157", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644359567, "uuid": "46dc2ebf-9b7d-4b1f-a153-5568e61ffb4f", "comment": "Malware payload", "value": "781f1cd813312b4ca5595bd2cce58dda9291f9f0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644359567, "uuid": "1d11337e-d8d9-43d1-8f1b-74f0a0d713ea", "comment": "Malware payload", "value": "3eb56f101a0208a3d05db43deb3b62f4ced0c3fac9847957f24f0f61582c240182fe814c2048f43c1331f6a2afefa2b8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644359567, "uuid": "dfc63fea-d035-4ff3-8bff-34ef4f916032", "value": "T12BC35A55F685EA1ADE0822350DDFC7F97336BC828E9A83473299B32F3D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644359567, "uuid": "47030a02-1eb6-46c1-9cc6-ae894bbf9f1f", "value": "3072:O6cKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dg+B8:ncKoSsxzNDZLDZjlbR868O8KlVH37kep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644359567, "uuid": "45fccee2-be8b-4300-9767-6c39921a9fd5", "value": 123867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644359567, "uuid": "788a8708-c22b-48d6-9649-6b6095e1e496", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644359567, "uuid": "527d0920-6635-4ff3-8e57-e5861c9fd34d", "value": "tmpkm1eg_v_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63f0e85-887d-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644283485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283485, "uuid": "cf8c4303-97e6-4042-b5ad-ae89569bb5e0", "comment": "Malware payload (Loki)", "value": "7f3e32399d43115449546b5798168b25", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283485, "uuid": "66eed6b5-933c-448c-8b53-16d453e06a39", "comment": "Malware payload (Loki)", "value": "391652986ed547047fba6a0b5c07f409eda5377cf5850f6e3ff52459c20a6200", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283485, "uuid": "de80850c-a5df-4da5-82a6-0152ea0603c0", "comment": "Malware payload (Loki)", "value": "9a4c8da4aae9b1c056d840f8c1c3fea67f0fef6a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283485, "uuid": "c6eb367b-a0b4-453e-90ab-70e22613aea4", "comment": "Malware payload (Loki)", "value": "43e797fb3931df2a0a1631c3861c0350d2aa180072172dbc7bb4eb381c0044da942f3d6358ffd93f5137da5c816ea46a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644283485, "uuid": "21f32552-5161-4362-8975-39b30eb8a4af", "value": "T179F4F7E8B12035EECC5BDB318B34CC349A117DBA922B511E10DB3D6B7A7E5978E150A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644283485, "uuid": "7c9b7a7b-7f76-4b04-aabb-ef089815d17a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644283485, "uuid": "0db398de-1e59-44a7-bf24-9d5af9100f12", "value": "12288:eeEacTyuJsmzi3hoUbIRQ/cqeJNdrSuWE6GKHRGAQjApDP7r9r/+pppppppppppG:ee1a6mz8mi/sjAx1qu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644283485, "uuid": "0a79bcb9-f168-47bd-9549-96050c867a2c", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644283485, "uuid": "7a1fc715-6020-4e8d-b40e-59f3eece34f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644283485, "uuid": "95d493fe-64ba-49e5-86cc-1290928f5b80", "value": "FACTURA DHL.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc97e649-88f4-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1644334552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334552, "uuid": "e6848f1d-cfa4-4f84-8400-d4e8ac7e42b3", "comment": "Malware payload (AveMariaRAT)", "value": "ce62d87215e41c8ed64c419e78cffe56", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334552, "uuid": "ade7bcad-5496-47af-b289-c85059c435c6", "comment": "Malware payload (AveMariaRAT)", "value": "393c2fddfe04f6289eb95db13f7b0882b3109ab1863983845db5001cb32ab738", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334552, "uuid": "5959d4aa-ffb5-40f2-9273-f23a55e6e4da", "comment": "Malware payload (AveMariaRAT)", "value": "8b1818152b9ea3b3c51faffb073a324bdd3826d8", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334552, "uuid": "81e1f98b-d798-4d59-a774-c336fc2d282e", "comment": "Malware payload (AveMariaRAT)", "value": "4533d3fae68ef886a1cc59d3a536b75b0e2f0e3ea58580bf29deb3dbdc9a1622594958dffa6375afa2d435bb894bd0cd", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334552, "uuid": "e475635c-8afd-4da0-841c-f454a8e7b602", "value": "T1E7F4CFAC329575EFC41BC8329A687C60963130B387CBD603A16B169C9B5EA67DF005F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334552, "uuid": "4664bfa8-4910-4692-aab1-077457463f28", "value": "12288:FtfSV5aWfGm69hFTWGrLE00Sf6Exk0UOMzDY/VN0koakAUhnw6:k5T9gTFXuS9wvzON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644334552, "uuid": "f6ad454e-aae4-4772-90cf-44a89430800f", "value": 792576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644334552, "uuid": "e1add336-fdd6-4d5a-b663-d472e6879548", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334552, "uuid": "d2c44654-b3bc-4ca8-bcd8-9ebd3f462e28", "value": "DHL6368638172 Receipt Document,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ca9fbe-891a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644350566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350566, "uuid": "f8fb3515-ed42-4b88-be11-3bb69be68810", "comment": "Malware payload (Heodo)", "value": "a683f66d9e754051d4fcee4a4f702476", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350566, "uuid": "17ea1a65-b9dc-4086-9d15-633d95b95c0d", "comment": "Malware payload (Heodo)", "value": "3944152f6c48c768ee470038da3a228d33336287c19afc350708e494411b69aa", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350566, "uuid": "f16b08d5-3c16-49d7-85de-dc497cca9cbb", "comment": "Malware payload (Heodo)", "value": "da19e443df1ff343ed125199d0da86066d3e5841", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350566, "uuid": "86201fce-eb43-4824-b15d-c1c0b6f2c267", "comment": "Malware payload (Heodo)", "value": "eec54309603245959d64a5e5fc78d81ea43fe50dfa4e5390a3512bf8149f7e9037a4b0bc58b3a1e32660decd913f8f88", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644350566, "uuid": "c859cab7-c068-43e0-a0d2-122d7a16e0ab", "value": "T19EC35A55F685EA5ADE0822350DDFC7F9333ABC828E9683473299B32F7C76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644350566, "uuid": "1846dfc7-9026-4dec-857e-c75e372333ab", "value": "3072:MjcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBF:AcKoSsxzNDZLDZjlbR868O8KlVH37ke9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644350566, "uuid": "0ab86241-0677-4709-9677-361436fcd65c", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644350566, "uuid": "c4e3347f-c065-49ae-b134-259b158e42cf", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644350566, "uuid": "06e98d6b-8515-4fa8-84a0-27d204fb875c", "value": "tmpsvwd8zg7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a2f437a-88d1-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644319274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644319274, "uuid": "db034ccf-39e0-4129-95ef-c97616d9c4b9", "comment": "Malware payload (Formbook)", "value": "d9336c3dec5b8e6cf6b694e402617b05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644319274, "uuid": "dab3fd73-7e24-49fe-b4c7-df5152c332ac", "comment": "Malware payload (Formbook)", "value": "394e89d915d3fb185d741576cc322d02b4f58d6debf49f058ce8df91682782b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644319274, "uuid": "b2f8374b-ee79-42e5-9c9c-70144d05962d", "comment": "Malware payload (Formbook)", "value": "f81d92c2d5ea23e6cb10afbfb431edd8de9e1012", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644319274, "uuid": "4d24d09a-1bc2-4e3e-8a83-9fd0298ed743", "comment": "Malware payload (Formbook)", "value": "ebcbe38ccc453bd6e78dfa72e5aa46e83329a636ddba7ee5b543bfa22d43cc74474374df290818bd71186c210a360583", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644319274, "uuid": "b22eacaf-03c3-49d2-bd27-5355bf38a7f3", "value": "T142949CC197C2CCFFF8ED4E35A0D29A2856966D1764E0255E0A4C3D207A731B32CFB95A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644319274, "uuid": "f83f1f9d-57ef-4a36-898b-0283130614ab", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644319274, "uuid": "c98a9236-6526-47f7-817e-b3aacedaf41e", "value": "12288:tUHfLLLLLLZLLLLLLLpLLLLLLLL3m2LLLLLLLLLLhLc3LLLLLHzBIVEqmH2lyu8E:tUHfLLLLLLZLLLLLLLpLLLLLLLL3m2L/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644319274, "uuid": "ed13e638-b06c-47a8-9aaf-e34639ff402d", "value": 436529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644319274, "uuid": "f8842e51-d98b-459c-a5c9-1cab832596bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644319274, "uuid": "67f851fe-b575-44a4-9342-b6fa1c99e8cd", "value": "SALARY_RECEIPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "922a3eb4-88c2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644312979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312979, "uuid": "266488af-b9c6-48ae-9aa0-b2726643f588", "comment": "Malware payload (Heodo)", "value": "018a5c0bf22509f2fc6c6f175c80b4c8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312979, "uuid": "427b03b1-d585-411d-bfb5-3bffd54ee704", "comment": "Malware payload (Heodo)", "value": "39761ad10c33220c837f597e27e3ffe2ad1ef95a61fb273fad0e6e6770af7116", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312979, "uuid": "4a046c7b-0a20-4e51-9b52-8afa94adde7b", "comment": "Malware payload (Heodo)", "value": "6d7a3928d601dbe811ef5e9420f7391045063899", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312979, "uuid": "27f5e73d-b19e-4186-8279-fb777d9c154d", "comment": "Malware payload (Heodo)", "value": "56a941cc0b3e26c174e7488b0d017bbfce9d24ad3d190d2657d36ecfc216c00ccd3d79233a633d4954b10accefc00c5b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312979, "uuid": "7e0b7197-8cf2-4c8a-ad90-961e38379428", "value": "T1F1C36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312979, "uuid": "63d1288d-90d7-48e0-872b-f376df0293c9", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644312979, "uuid": "5dc1342e-23e9-482a-bdb0-60988ae15e4d", "value": 127882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644312979, "uuid": "efabe81d-a915-461c-bff7-78fc954a0bd2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312979, "uuid": "d5d8c254-2696-42cc-8ed8-624d5f033d53", "value": "tmp00ocuc9o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf68e5c-8938-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644363839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644363839, "uuid": "dd0bcb8e-2adb-4561-9af0-ac2c3c2f0140", "comment": "Malware payload", "value": "a707060dba3678ef4df103f6783ddf80", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644363839, "uuid": "007f2c73-ce42-4326-a983-b7a11fc275eb", "comment": "Malware payload", "value": "39c7e6e24746ef947b6f413cf4c965d730044dde4c325838718dd6428ab22125", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644363839, "uuid": "e433cc80-3d29-4b3c-9863-c3edf0984433", "comment": "Malware payload", "value": "e5a9fed2f3f35eb329b29fd62564b8f29b4c127f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644363839, "uuid": "c22ec499-d0b5-4ac7-acd4-b00aa12836b3", "comment": "Malware payload", "value": "8e87a9659cd7b0f6d9dfaddebff0c7c5922517c713cc663d70a5334b30caedd19d97537ee7d075000281f5ddf308cccf", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644363839, "uuid": "8b50271b-a033-43e8-b4b0-81630ba718f3", "value": "T156C35A55F685EA1ADE0823350DDFC7F9333ABC828E9683473299B32F7D76550CA12606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644363839, "uuid": "b7d54e1c-7c9e-4c73-9692-452458561c74", "value": "3072:0ncKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBn:kcKoSsxzNDZLDZjlbR868O8KlVH37keP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644363839, "uuid": "dddede64-96e7-4350-a690-b90b6f7d861a", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644363839, "uuid": "8e462c3b-edcb-4023-b4fd-524d7e0dfdd7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644363839, "uuid": "bf27c84f-3d8c-408a-bf97-8614dfddd769", "value": "tmp_6wgqcch", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45cfb74-8914-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644348255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348255, "uuid": "4f317212-9432-4e91-ac02-176add26dd59", "comment": "Malware payload (Heodo)", "value": "08c797d644862ca0aa7989506a98e6f2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348255, "uuid": "88f0f1c1-1658-4e02-91cc-77e7af34a9cd", "comment": "Malware payload (Heodo)", "value": "3a157802fefcfa39cda7ec01ea1691671a75aa367d695f6a34ecc6586090a2d6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348255, "uuid": "46249ad8-c24f-42e1-9b2c-fb80564e4625", "comment": "Malware payload (Heodo)", "value": "692dac97686e3854166f9bf8bbac3628d4cd9004", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348255, "uuid": "0fdf0b5d-daf2-4f06-bbb7-3e61b1aeb956", "comment": "Malware payload (Heodo)", "value": "4350aec09645e7c107b99318f4e5a8e4294d87e88b61e0f5dd402b0dcac401f02fcf87d1a730d0b2cce664a9672d8223", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644348255, "uuid": "da161d88-4fb3-420a-9bfe-91d5c5375050", "value": "T10CC35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644348255, "uuid": "90ce301e-0dd8-4c20-81d4-6ede32a3a541", "value": "3072:gacKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBR:pcKoSsxzNDZLDZjlbR868O8KlVH37ket", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644348255, "uuid": "09831004-59b9-493a-b061-140c1c1c420e", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644348255, "uuid": "9488d137-f100-4541-9167-a9cc8a02aded", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644348255, "uuid": "bc122220-64b7-4318-906b-f600463300a0", "value": "tmper3owmf3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b674fb-8901-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644340205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340205, "uuid": "1e5bc4dd-3d84-4c61-8d2c-33d69ea43cf4", "comment": "Malware payload (Heodo)", "value": "1eea9d3a060c9f495345254f44c02c17", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340205, "uuid": "fa19d5b6-8c2a-4aee-83f8-8cb5904ee864", "comment": "Malware payload (Heodo)", "value": "3a29fbae0acb2d331ea40bef4df5d4995b8b1b7bdfaa67b39aa53bdea4a461a3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340205, "uuid": "34358e3b-e99f-4ffe-9cb8-f3999cb3f37d", "comment": "Malware payload (Heodo)", "value": "831799e517aaa107f0991ceb9dd7a029717e4a70", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340205, "uuid": "4d9c7370-7c75-4e29-8c83-344d6dcdf169", "comment": "Malware payload (Heodo)", "value": "6f10f5a5404a973e42eebd5255221b97e07c1a5a67f82d6602a20d43fd3fc21e500a07183218d78f8b2984979f256e07", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340205, "uuid": "d4ab9dd1-ac68-407c-83f7-1395c367542c", "value": "T1BAC35A55F685EA1ADE0822350DDFCBF93336BC828E9683473299B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340205, "uuid": "8a0b52f6-6a72-474f-a4fc-4c55ca19e820", "value": "3072:4WcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBE:JcKoSsxzNDZLDZjlbR868O8KlVH37keQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644340205, "uuid": "12a790f0-090a-4004-b9f8-659e6ff60a68", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644340205, "uuid": "64306293-ae42-439b-b765-a189616425fb", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340205, "uuid": "2b55e05d-7ae4-44fc-8de7-71858918c541", "value": "tmp3c5j9cfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "720afe9f-88fd-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644338266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338266, "uuid": "5caa427e-6df6-435e-857a-a04a9f5422ab", "comment": "Malware payload (AgentTesla)", "value": "cd5c1b362a430364019145203397d13a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338266, "uuid": "167551af-decd-46c8-aef4-c13c9242b4df", "comment": "Malware payload (AgentTesla)", "value": "3a2da04237994d5d70ee9b3e127e028ebc81803bf71551ede00e6ca780a68b3b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338266, "uuid": "362953f0-20eb-4d07-8541-6603535b31ee", "comment": "Malware payload (AgentTesla)", "value": "56f5f2620300359d7b66c23e110ef5cc07d82e51", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338266, "uuid": "f7ac5f8b-ca76-477f-93d1-654e0c2872c8", "comment": "Malware payload (AgentTesla)", "value": "bb8383f681baff3ee616c4983a0380310fc62b3b1e55e75f544aed9c384eb0ff6b226a0620ffec5446ce5f2d9fa7ba1d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338266, "uuid": "cd8a2e81-a1e1-4c15-8824-dedb141284a2", "value": "T179141254722D1E9FF660C1FDC9528364639FAE08DE1D554D29A6FBB5033062A3BF803A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338266, "uuid": "9bea4469-d9f0-4002-82cd-d5f1ba7f6baa", "value": "3072:eHhcjKS+H0MaHqxib5+kn8/b0wV32OMW1o+Edu0pHBw6/+sl4+9K:mcjpHqQFzAN124S+EdHvV4+9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644338266, "uuid": "ae96c350-1bb5-4677-a7cc-ccc365764b71", "value": 191592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644338266, "uuid": "1f7fdab1-1934-4cdf-b773-63951c6ba2e2", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338266, "uuid": "934b387c-2c64-4657-ab26-4836a17ed25d", "value": "Order356443.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8a8b36-88ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644330099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330099, "uuid": "ac6e18d8-e374-4d20-8c5e-b4d88d147563", "comment": "Malware payload (Heodo)", "value": "947d71d25b1b6ae1458e12fe1a1eeabd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330099, "uuid": "0768df62-b362-4b8a-895d-066610425842", "comment": "Malware payload (Heodo)", "value": "3a57f46b30cf3a5e9efe58fea844f74ec3e61f28352eee93ab76894b7dddf49b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330099, "uuid": "b34c2ae6-6e87-4e3d-853f-6560ca5f52ff", "comment": "Malware payload (Heodo)", "value": "420a201a4c059d3775a26eb42e6da6d1c8cd770e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330099, "uuid": "0458e0b3-ac6d-4f91-8f30-c8de7ad912f0", "comment": "Malware payload (Heodo)", "value": "8b820879e70bd0133badaccfe2410de97f13a6d547f8e39003a7def2082578b410f01161695a39377fd3e59301a7417b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330099, "uuid": "ebdba1e3-77cf-44b4-9bcb-b02211fa3adb", "value": "T17D848D06E652C03CFEFB04B8D496CA66ED5E3A24169D619F63413A6D32613CF123F52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330099, "uuid": "2c167593-2e92-4ee0-aa35-cca6a525b222", "value": "79fb40281049052b3e354a6e444da473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330099, "uuid": "f900d325-6188-4f78-815e-e90afda34a19", "value": "6144:O56dLjBFLyztOooeYIjAmkB8lebi9JqGXdZ32mneM0laNUIbeURK46:YszuzNLjWB8f9JqQ2mnB0l4UMK46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644330099, "uuid": "0d671fdf-df8c-4782-99ff-496dfc6555f0", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644330099, "uuid": "b11fdc14-92b1-4667-9e53-da9a2ef69802", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330099, "uuid": "64f33868-f223-4d17-ab35-f8d2eb1c45ad", "value": "emotet_exe_e4_3a57f46b30cf3a5e9efe58fea844f74ec3e61f28352eee93ab76894b7dddf49b_2022-02-08__142127.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52920cca-88bd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644310725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310725, "uuid": "74cf530d-c788-476b-af86-74b792c90816", "comment": "Malware payload (Heodo)", "value": "0bb455d02f8f19422273bdfa364e828c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310725, "uuid": "0ec179b8-5a93-4597-9353-3e1f517bbbe1", "comment": "Malware payload (Heodo)", "value": "3a85926ae3809907fe5feeccee7d5b6c2a68bd70a87d3fc5049d63c328312a1c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310725, "uuid": "b19aff27-181a-49be-85c0-2aeb05ddb24e", "comment": "Malware payload (Heodo)", "value": "ec62ac7c83c953e5003fd87f70f5f76b61de4ca5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310725, "uuid": "eeb86dd9-60ee-444d-a747-9d47bc63a5fb", "comment": "Malware payload (Heodo)", "value": "910961f9972a8b0776f873e7624074aed22e42b183b037924f45f75391a76a96525ce24cf432925b8d70cd57161a09ac", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310725, "uuid": "a901ee8a-71a8-4ee1-9185-322109bc0d4f", "value": "T17093499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310725, "uuid": "7713ca9f-9ffa-46bb-aa71-082f53f8eca4", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644310725, "uuid": "f1f99f36-c627-4058-84b5-e7c7b4b93cbf", "value": 96867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644310725, "uuid": "c86cdf51-4e01-4755-95a6-67bb1503bcc6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310725, "uuid": "4ecacdea-ec20-4a39-a969-142dd2f665ee", "value": "tmp8dr46nhn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b363d884-88fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644337946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644337946, "uuid": "dea86286-d10b-4a65-b833-f8b259444517", "comment": "Malware payload (Heodo)", "value": "54d7df60d3b16e405861faac06afd0f4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644337946, "uuid": "b3b5054d-193a-4123-88ec-8ad7e91d0740", "comment": "Malware payload (Heodo)", "value": "3a9795d9cc7fbd8462e3dd582f47f447552527f0caf0646f3dda881c1c2c9dad", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644337946, "uuid": "3252c16f-5727-4b72-b952-4fdc9ebfea7b", "comment": "Malware payload (Heodo)", "value": "865288198e54c8c425f7eea810c2019f4ffb7386", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644337946, "uuid": "d98c4064-56a9-4cf1-a628-151e3c621869", "comment": "Malware payload (Heodo)", "value": "af0fb0da9782b9ad68473019bbf51249eeb548bf88cb8c00bfdf977d0b079420290a55f593838c9a28797b2fa343d596", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644337946, "uuid": "a01339e8-18cf-4a3e-9baa-8af2073a9e86", "value": "T157C35A55F685EA1ADE0822350DDFC7F97336BC828E9A83473299B32F3D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644337946, "uuid": "3896e6f0-292a-4b70-bc13-549930a14d6c", "value": "3072:7ocKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dg+BW:scKoSsxzNDZLDZjlbR868O8KlVH37kef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644337946, "uuid": "b5c635b5-40d0-43ff-bfce-183a9a3862a9", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644337946, "uuid": "eec5f455-c46b-4734-a67b-349aafc76c10", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644337946, "uuid": "e8cd3864-d08f-4dcf-b5a4-8449791b1d6c", "value": "tmp5nbg74nv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81e1099-8930-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644360368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644360368, "uuid": "2d27f270-a1da-4b8b-b23f-25df9c2b5c17", "comment": "Malware payload", "value": "ca442d5a3b16994d7c5696b3a132471c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644360368, "uuid": "4115ca6a-e9c8-4652-9f48-28835261ed29", "comment": "Malware payload", "value": "3ab7563b9b89ff81e99adcdf4b04403f20a6ec28b36ff9ba802bd4542d5d85e9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644360368, "uuid": "6bf6db75-faeb-4613-9b49-8e79d894c686", "comment": "Malware payload", "value": "9fa4f580fc7edf7ddb40671034e351c68a370084", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644360368, "uuid": "2c99ff8e-a2a3-415f-b23a-a8a40d0bbca9", "comment": "Malware payload", "value": "cb00eaedad970c6ad94c8b338be2abaa4d65f559798c4bd516f6394298e1a7e383939e8bf5951b996f9e7996a4d4784b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644360368, "uuid": "aff07229-9b40-4041-813e-f75019d3d6f4", "value": "T1A6C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644360368, "uuid": "b41b84ef-6c29-48ed-8403-b7901c02cc2a", "value": "3072:AlcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfB9:acKoSsxzNDZLDZjlbR868O8KlVH37keV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644360368, "uuid": "1b7a4083-f2b8-4d05-84ba-9b3ee7d7731e", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644360368, "uuid": "e00335cc-23bb-4233-a768-fab53042b96f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644360368, "uuid": "1fde732f-e851-4542-be80-f4b3593ea3bd", "value": "tmpexq2kr8o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a5dc22-8876-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644280285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644280285, "uuid": "ea0a37a6-8995-4fc4-86cf-eab06c812d82", "comment": "Malware payload (Heodo)", "value": "faab2200827e54217f37e2d24c4d26d5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644280285, "uuid": "56925bb9-974c-43ca-a8aa-5b2bb5811505", "comment": "Malware payload (Heodo)", "value": "3ab8a29e187351bec5f77193296b2a9b5883b72389f9bb66db76cb469513e16c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644280285, "uuid": "f9a1201e-2539-4eeb-85f0-8ade23e706c4", "comment": "Malware payload (Heodo)", "value": "a491ce3d32aa8f74877905f1f078a112221515ad", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644280285, "uuid": "dcce31b3-a7e4-46ea-aff3-2e55c1d1641e", "comment": "Malware payload (Heodo)", "value": "8aa4b7537beee5b839f0b878e88e54a2c13c319121905a81e913426a2e37dac8319791cd901cbd228897e185904f9469", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644280285, "uuid": "9c4b4d6c-57e0-4356-a434-03774463aab6", "value": "T14393E12D2E1C6D0BD5DFF3389E3CDA61C2155CA06662F47A24A06F7D413D853C26BA6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644280285, "uuid": "def524c4-4725-45ee-921c-6f438d7ddc67", "value": "1536:zZRESsV0Xdld6qKSEIS0mKGAC64eSKa3Xm1WBXz7yL64i+kkfa+3gtfvjHtoxzgO:zvbsaXjgBSEB0/GAC6Ha3Xm4nC5X5gxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644280285, "uuid": "87b3d260-f1cf-4c8b-a59b-bf1b762dc0ba", "value": 94228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644280285, "uuid": "af823fb7-388a-47a0-b9ab-e13b711028f8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644280285, "uuid": "9ea1ba1c-25eb-49b2-aa95-e3c5f0c293dd", "value": "tmppmaekkux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14dafa6f-88a0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644298166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298166, "uuid": "a968a37c-af37-484a-8977-676a2e0092b0", "comment": "Malware payload (Heodo)", "value": "189bcc726a13929d445fd99208003686", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298166, "uuid": "61aedabc-8773-4c84-9f22-19587550a286", "comment": "Malware payload (Heodo)", "value": "3abe4a3afc5973deb65b8a8618a09fe8235ddfd8c17977ebaeb03aca780301ce", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298166, "uuid": "b39f2bae-f155-4798-894c-d6161ab87ac0", "comment": "Malware payload (Heodo)", "value": "62ea1d692a5bdf21ff97da59d08ee91bc923036a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298166, "uuid": "9a1e80ad-aa5d-4723-826e-132745c791a4", "comment": "Malware payload (Heodo)", "value": "fe39fd22dcd8d8ddd3dc0b82f3cd08769218ee2adbbac5d39a987f4a4f3d5c04fa3dc474c2239ef282c075b49535e8e2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644298166, "uuid": "64c3cdbc-1c3a-4ddd-909d-5fd1ff4d706f", "value": "T122D38D6ABA48CA0BD94913314EE7CBF67336BC819F5297473295B72E1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644298166, "uuid": "3ac85907-9db6-4916-bce5-28366980ab35", "value": "3072:bcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3T:bcKoSsxzNDZLDZjlbR868O8KlVH3skeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644298166, "uuid": "77458752-b03a-4ff8-b585-fdf4947a29ff", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644298166, "uuid": "59701ed4-b269-4b76-b397-f88ad28c1247", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644298166, "uuid": "4ec0dc37-9b5d-44f7-8b33-8aa1557d4af1", "value": "tmp7st9tu1p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff3ff67a-8921-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644353965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644353965, "uuid": "35ceba38-66cf-4228-b932-e8adb0a997b0", "comment": "Malware payload (Heodo)", "value": "b4ebd466d93c30e430fc58aa3d866737", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644353965, "uuid": "f243911b-eacc-4627-a28e-fad23edb924f", "comment": "Malware payload (Heodo)", "value": "3b09a35fb5464e5be9b73d594b419a726763444a43ae738de48ced214de4a972", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644353965, "uuid": "3a022ded-e3e1-40a6-ae00-e52e5c5fdad9", "comment": "Malware payload (Heodo)", "value": "a378822a7baba18e3fbabbe8a3e497923b7935fd", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644353965, "uuid": "b6b6b7c3-0c9a-4998-b4c5-4ed9a7d3ba55", "comment": "Malware payload (Heodo)", "value": "00ab711976bde18394cbb6fe9eeb2fb14c809bd47f8e101ef63bcc4f40a5160bc01f3dd9766bc391a9a5e6e99196fbd5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644353965, "uuid": "a2387dbf-e198-4d0b-b7e8-66e5486c165d", "value": "T1E6C35A55F685EA1ADE0812350DDFCBF9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644353965, "uuid": "3bec4465-d1d8-4b9d-9c6f-24ac91e914a9", "value": "3072:G9cKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBF:UcKoSsxzNDZLDZjlbR868O8KlVH37keN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644353965, "uuid": "a6f9a083-05ae-43a1-894a-8c13b8fe1e38", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644353965, "uuid": "542e0505-92a6-4818-a5d3-f612b50cdc95", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644353965, "uuid": "4e16becf-a7e1-4445-9bee-ebf757f71b3e", "value": "tmphi4vuvcl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e07ad8-890c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644344602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644344602, "uuid": "c17f8b14-7e47-4061-8608-5c8f5e272631", "comment": "Malware payload (Heodo)", "value": "2fc93fc3fba4829f132496afda2bf39b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644344602, "uuid": "ccaf1beb-1932-441e-87c3-4e98c090e96c", "comment": "Malware payload (Heodo)", "value": "3b240a407f9238aaf8b8249e870cd5b2e9ed4ab36c02d482b24049c27d134bd7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644344602, "uuid": "2171eec4-8145-4f47-96f5-808ae8882cf0", "comment": "Malware payload (Heodo)", "value": "424c1462384ed3e81d576f66d2856139accc6a99", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644344602, "uuid": "d0e93ee2-5362-44d6-80e9-447c1ce75798", "comment": "Malware payload (Heodo)", "value": "122d0ae4c60e0cf9c5e636bd4164a0fd1f4b5e62f53879f002a0b05a46624c3e132637d0a859ed6d7210e6b050fa4e57", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644344602, "uuid": "84d08a1f-c4a8-4931-9dd0-551e77ad70d1", "value": "T1CBC35A55F685EA1ADE0822350DDFC7F97336BC828E9683473299B32F3D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644344602, "uuid": "ced4df58-c34b-4557-8ab9-39b643b6de56", "value": "3072:ljcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgiBK:VcKoSsxzNDZLDZjlbR868O8KlVH37kej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644344602, "uuid": "ac8a1aed-4986-4bfb-885e-07defe5e1e1e", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644344602, "uuid": "d7f65057-758c-4c2b-826f-2b0d952016c0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644344602, "uuid": "d2a67021-0a45-4bb1-b9c9-209c5362b085", "value": "tmpn3mo7qad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a12f73-889f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644297929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297929, "uuid": "05298aa8-a6f0-4204-a8c9-983b904dfe16", "comment": "Malware payload (Heodo)", "value": "70f026f8d7112840bbe6397e600f2f4c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297929, "uuid": "cef4ed74-c7c7-419d-b838-6810ea9837e4", "comment": "Malware payload (Heodo)", "value": "3b54d27fc56406a1701c7d60540424974cfcafd8354895d2fbb4988db3e4a996", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297929, "uuid": "3238ebe0-9c1e-468e-aaf8-601537cbbe53", "comment": "Malware payload (Heodo)", "value": "c02f1638b14c86804a5a6486857ef8e7f8deca41", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297929, "uuid": "d9b0935d-4aee-453c-9fcd-b7aec5251af8", "comment": "Malware payload (Heodo)", "value": "0b95b019b08b83898a0e7a395c53e19bc38fff4efd451b8809bf5428f9ed0c8c1140566bd6fb748672e409862c6e1e82", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297929, "uuid": "cd912eca-8c82-457b-af9c-d7f8e1821231", "value": "T18093E15D7D1C790BE2CBF239DF38E96052251CE062A2B8B960517BBD413D463C26AF6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297929, "uuid": "75221d09-5d1f-471b-99df-087b8c203c1a", "value": "1536:zZRkPTGJ358ASKa3Xm1WBXz7yL64i+kkfa+3gtfvjHtoxzg5bjIFnk:zvk7A5Pa3Xm4nC5X5gxvhoxzMIxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644297929, "uuid": "f72235ef-0293-43de-a893-a2eac79cd2f7", "value": 94224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644297929, "uuid": "3ed2b19a-938b-463d-aaef-e2d8b2d82ee9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297929, "uuid": "8f3050bb-c86e-4da1-b3d1-87bc03545dfe", "value": "Notice0802.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2ac0b8b-887a-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1644282164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282164, "uuid": "6ff875b7-d018-4687-a9dc-b8a2abe33758", "comment": "Malware payload (AsyncRAT)", "value": "a821f2cbbf955d86da5fe4db7bbc51b3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282164, "uuid": "032bbeeb-51e1-45a1-873f-a051cedb8574", "comment": "Malware payload (AsyncRAT)", "value": "3b5a24e02bc19ac94b95114ffb271dee77d7bce54e51cee380ef098dfb6f8a25", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282164, "uuid": "7b56a628-38d3-4698-9fd7-b24b46f79ae1", "comment": "Malware payload (AsyncRAT)", "value": "bc7382a467f2908b0907e8f28a6ea52de624a559", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282164, "uuid": "a7862848-8615-4896-bb51-40c7d264d903", "comment": "Malware payload (AsyncRAT)", "value": "0f99030a1a4d880f86484950b37b6cd9ef33d9de435f528765692b9b2fa00fbcc6e695bf06c4b8d2d75ecc5b56d07ed6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282164, "uuid": "d3a73c35-690b-42e2-889c-73c49b0f0591", "value": "T1D905230B376B9126C7BD42B629A3C09447B1F8A65C23DC2EAA5150EF9E3136C74C3E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282164, "uuid": "c80eb6e1-f6a1-4d41-bd8b-cb33a34d6226", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282164, "uuid": "18be623a-5f4e-4374-b0f2-815fe9dbd1f8", "value": "12288:3G8yrr0RIsu8pHZzvExXA61EWjDWbLNjOM2Y5a/JzdXjgL4beSXRyFUF0SktVYxT:ArkBeXAxWfWnB3K/PX0sbeURjF0JVYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644282164, "uuid": "32bf1ea8-14b7-4ea3-b55d-ae3dfbc2e579", "value": 857088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644282164, "uuid": "1ef14acc-70ee-4a0c-9bd3-e3018c014223", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282164, "uuid": "2a7e0a8e-7076-4723-9cab-7028c3b79f4c", "value": "a821f2cbbf955d86da5fe4db7bbc51b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63830180-88e2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644326645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644326645, "uuid": "c5cc1694-cc6b-4954-9a93-e3fdc0c7cf15", "comment": "Malware payload", "value": "11fdae82457895858711a31a01932352", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644326645, "uuid": "fa2231e8-8be0-49b1-972e-4851111375a3", "comment": "Malware payload", "value": "3b62f828e85917cbf97175e30a7682a940814608c64d9ba19053b6bf8d05b34f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644326645, "uuid": "70526d44-615f-4db1-81ef-6e5e0674e742", "comment": "Malware payload", "value": "6004ac6d78bfc363e812877d8be82bd9c9fb0c38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644326645, "uuid": "d996b3d4-f8e0-495f-b4f7-170763114bf6", "comment": "Malware payload", "value": "5a7e446dbcf43e5fb21ed0d016aed3cc9f7eb28eee0a8e4013ed5df89861a273c2dc5ffc8aeff02b03c948160624c165", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644326645, "uuid": "6e9e126d-1b81-4692-992a-1918a28078b4", "value": "T1B282C0409B0487D3E4D27F32D8185BB57FADE462EF6CAA6614D6DD8E422003864C5FA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644326645, "uuid": "c8e1fea6-8614-45c6-a2d7-95e477831aaa", "value": "384:rtTf4jWFR/VL6+y+107u31zlptmjKb2wgUrRabpccToNeahAFKXW:rgWxLk+107WvptmOqwd0bpcrmwXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644326645, "uuid": "5934b097-b846-4ffd-9b1b-22f0d2928020", "value": 18932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644326645, "uuid": "c730c9dc-7dcc-4b18-a83f-24b9993e1c1a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644326645, "uuid": "d98c9ebc-22b9-46e4-95d7-ca3b64d82b2f", "value": "bot_mips_eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b60d66d-88bb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644309854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644309854, "uuid": "02980e4e-a3fc-4834-a078-71400d5650f7", "comment": "Malware payload (Heodo)", "value": "ca30998e4b970c6b7244a54ec05313f2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644309854, "uuid": "1ea262e9-c73f-4b31-b3a6-8ca11b3fdde5", "comment": "Malware payload (Heodo)", "value": "3b660f42090a2e1cc90fb57ac5ff275680596945e7bb159cb6d0f4b563be7427", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644309854, "uuid": "54af5582-120e-444f-ac0a-b015cb26fc78", "comment": "Malware payload (Heodo)", "value": "5f4c2a2138cd1219d4616ebdc70d963acbae0d23", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644309854, "uuid": "a43f7ed3-3cd8-4ca4-884d-4e0c88b477a3", "comment": "Malware payload (Heodo)", "value": "08aa5a5686d20bc8fcb87f0e9958ad60a0721ad1e7d38a042e8d036edd1367ac9e31d089f56cf680cebe62430e09b30b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644309854, "uuid": "ef2b1868-20d6-4a0f-b7dd-12fd539b3474", "value": "T177C36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644309854, "uuid": "081411a6-b4f6-4fc8-9d6a-c3557a192434", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644309854, "uuid": "dc990673-96fd-468e-94bb-114036a964b2", "value": 127709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644309854, "uuid": "6611e0a3-e1a7-466f-9b59-a3a0fae344e8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644309854, "uuid": "fc8269e4-0893-41ce-9e71-250d6a214d7d", "value": "tmpz6crw6ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815f828e-8938-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644363632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644363632, "uuid": "9d7bb43b-355c-4b73-91ac-87a7cfee7739", "comment": "Malware payload", "value": "193ea899461342cc1c118d7d8da7c2f3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644363632, "uuid": "3f25af6c-396e-4e03-b918-4e2a383078a5", "comment": "Malware payload", "value": "3b94a4423f2eaab390b43f692d2df55f42b6f77d89d57fe96107385be1eeee9a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644363632, "uuid": "86317062-7005-45b2-b36f-a4ad66c12127", "comment": "Malware payload", "value": "174e650a50e58ac65bc5f9418a947e233ed6789e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644363632, "uuid": "cd4aee5b-a70e-40a0-90fa-87b33ceba0a9", "comment": "Malware payload", "value": "03d04df9a294e7a9b89a6d6f7771d1581ae5248f5210d3c07f66a68470b81884c098d4ae148e9192c4b7b60d77c7a643", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644363632, "uuid": "d0d42306-81c7-460f-bf37-30e66c902087", "value": "T1E2C35A55F685EA1ADE0822350DDFCBF93336BC828E9683473299B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644363632, "uuid": "d9639123-c879-47f9-8400-2b344e761d30", "value": "3072:CBcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBO:ocKoSsxzNDZLDZjlbR868O8KlVH37keW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644363632, "uuid": "3579cfea-ba5d-49f2-9254-a7573f3e709c", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644363632, "uuid": "542aaff7-23e0-4f4b-ada6-3745cfa87a4a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644363632, "uuid": "20e5f2d2-2efc-4bab-bf5f-e26dece8516d", "value": "tmp44956ohk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d5b7fe5-8924-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644354874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354874, "uuid": "7d9eb393-166c-4d20-abc7-f72bde918343", "comment": "Malware payload (Heodo)", "value": "d86c2c44df378964dab5ad88d1de7d8d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354874, "uuid": "21846192-f95b-4275-83ee-3e1f7d0c960f", "comment": "Malware payload (Heodo)", "value": "3b956ad5094df2f605c6ab8498425a0ae1d277fbd84b54f5c802fc125be31bcd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354874, "uuid": "7bf869c4-915b-4805-93cd-552d843d9046", "comment": "Malware payload (Heodo)", "value": "6f90a9ae9a210ee3c6043c2e01864a5aea798146", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644354874, "uuid": "c81f9fa8-11be-4a98-8118-ea3df5c0e621", "comment": "Malware payload (Heodo)", "value": "77ae8acc4e9d06f358794ea085cb942e41f0a75fc64fea130c508958553fe357a9d5d1f9c3687e9c84904afa3f76adab", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644354874, "uuid": "6f94a320-2d96-475b-8905-c0f4a02bb8b2", "value": "T1FDC35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644354874, "uuid": "0cc65a98-4373-4653-97f3-cb88a7b12d4b", "value": "3072:2CcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBe:XcKoSsxzNDZLDZjlbR868O8KlVH37keW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644354874, "uuid": "7b5fe6c7-350f-41a7-99de-456882ff4400", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644354874, "uuid": "94b07cba-9ef9-4395-b8bd-1907e6379e61", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644354874, "uuid": "9fe976d5-7e10-4886-886a-7414683cf095", "value": "tmpjtv9ym4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecdd5072-88b6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644307978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307978, "uuid": "a1318cd5-9cc5-4280-9d4b-dfc1c1d524c7", "comment": "Malware payload (Heodo)", "value": "4b5dc5b4950e96c55298378cf8e504ce", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307978, "uuid": "42ea7cbf-93e0-431d-be9d-7120dd975cdb", "comment": "Malware payload (Heodo)", "value": "3bb10407bf9c7f547e1f2d40ecc109b1330fe1e1b4a2a6b6dccaeda690b73015", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307978, "uuid": "b81096d9-8b90-4446-8dc2-c2a843ede1c2", "comment": "Malware payload (Heodo)", "value": "2cb1dc43a31c99be476382ad70b1942e667f52c0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307978, "uuid": "32102591-f82b-46e8-9c59-d689f169a275", "comment": "Malware payload (Heodo)", "value": "6f55fbf5339a2abc5b020342c154f6f760bced59b3f0bc3c7782761346d162ea2a3f2b685e8361ed3e53b2d75e0f929f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307978, "uuid": "ef468f7e-b9bf-444f-84ea-1450d5c84355", "value": "T10793499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307978, "uuid": "0bd30f52-9e45-4eb3-9d31-4e7d63075789", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644307978, "uuid": "5de4b24c-c6f7-415a-9b73-6e06b361417c", "value": 96382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644307978, "uuid": "485effae-0d4a-47a4-96a9-4b3ef6e76b75", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307978, "uuid": "02b068d2-39f9-411f-b15a-a993b3aa8395", "value": "tmpbrxt2mhl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c060e0-88cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644318670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644318670, "uuid": "477bf7e3-45fd-4fb2-9fc6-6141405c2c7d", "comment": "Malware payload (Heodo)", "value": "bf6fab732af6f3ecef956ebc98e86905", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644318670, "uuid": "efe83a2f-707e-4359-a5a5-48874ce7735c", "comment": "Malware payload (Heodo)", "value": "3bb93a242155d7b1a13b27bab9fced7e762f62c848364c525bfaff19333ca2a8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644318670, "uuid": "73379efa-c5fb-4954-934c-2031b8b00c7b", "comment": "Malware payload (Heodo)", "value": "4dbfc21b499f1e22436ebb0882c5e0b1160cdea8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644318670, "uuid": "f65e46a0-919f-4662-a22b-a65245694e30", "comment": "Malware payload (Heodo)", "value": "0313fed74323f54b5b0cc92f45ee61116cc934e8cecee214de92c3f2123999d4e03c3dc880b77de02ba0598f932297c4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644318670, "uuid": "3e2e597f-9943-4110-9096-9a320a708f81", "value": "T12693499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644318670, "uuid": "fd339e63-6931-4cc3-b850-9ccc507a35f5", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644318670, "uuid": "c54db1c9-0d2f-47ab-a418-47c3fac6c190", "value": 97063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644318670, "uuid": "8e60955b-38be-4e13-bc45-087807d03aea", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644318670, "uuid": "52cb247d-ab31-4bfc-8398-a0660b96a98c", "value": "tmph94cs52y", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0842811e-88a8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644301581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301581, "uuid": "d3672012-d338-42d8-b9ee-d61bb957d94f", "comment": "Malware payload (Heodo)", "value": "0bb75f3c5dc401fb9d5fa3fb929a52be", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301581, "uuid": "c5a9c118-ad34-484c-84ef-d0314670fc14", "comment": "Malware payload (Heodo)", "value": "3bf429866fe4f7318ab73834b311bfba2cc61bee57427bdd453cbb364fa3dba1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301581, "uuid": "9e8591f5-5105-40d1-b7ce-5c949418c6fc", "comment": "Malware payload (Heodo)", "value": "e381f628214fc93373ca3f53af6d1b458977d8e1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301581, "uuid": "001bfd9d-1b63-412d-ac8b-27045600cc1c", "comment": "Malware payload (Heodo)", "value": "e0427e16c2f4a2750bb6430689c0a30caaefd61162dfa608932811dade70790ff5df4fbf07858db3ab1ac3746981336e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644301581, "uuid": "be274137-41df-4cc3-9820-97c5a505600e", "value": "T171D38D6ABA48CA0BDA4913314EE7CBF67335BC819F5297473295B72F1C3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644301581, "uuid": "8a10b57c-cb03-4446-ba16-acb6a061c1bf", "value": "3072:acKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3Q:acKoSsxzNDZLDZjlbR868O8KlVH3sked", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644301581, "uuid": "50bc115b-30c5-4838-9be0-78efaa8e7721", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644301581, "uuid": "fb4bf17d-057f-46f0-9501-b6a84ac1c4b1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644301581, "uuid": "5122d83d-08bd-4b80-9ff3-d867f0a85ada", "value": "tmphmidtfcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf564a8-8912-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644347463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347463, "uuid": "18832587-04a3-4b66-b925-44629c2b05d2", "comment": "Malware payload (Heodo)", "value": "d4474b0c94bc0c412283a3a0eba8bc46", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347463, "uuid": "7381bc85-5ef7-4255-a214-d3f990139f7d", "comment": "Malware payload (Heodo)", "value": "3bfc0879b88d8d9c41b0f896461f897c2ef6e4e3e97c08fc22ed5ef7675bd3ae", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347463, "uuid": "c782fa34-6076-46f7-b38a-9434c6c95a06", "comment": "Malware payload (Heodo)", "value": "2bb2e6453b0a2975ca2bd59406be5e42c10c9144", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347463, "uuid": "17864f55-c47e-4d8b-9685-cc729d5ee91f", "comment": "Malware payload (Heodo)", "value": "6c56ffb12e4c898c40b6b693055de451d515d9369c334bb13cc3516dffe31c43d122aa10fcc525dd310bc74865e1098b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347463, "uuid": "8b98a428-9139-482d-b7e9-5dd24dfe75d9", "value": "T19FC35A55F685EA5ADE0822350DDFC7F9333ABC828E9683473299B32F7C76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347463, "uuid": "491054db-586a-4edb-a07a-74829c3cb734", "value": "3072:RecKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBN:QcKoSsxzNDZLDZjlbR868O8KlVH37kep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644347463, "uuid": "61c33a5f-eb50-40e7-a255-8b6eb0215226", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644347463, "uuid": "bbbad43e-836f-48cb-b4e2-ac89491e129b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347463, "uuid": "f374e1e1-1242-40ac-81ee-c30ac5dae818", "value": "tmpogr_zl8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a49e457-8880-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644284646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284646, "uuid": "864c5292-1478-44a0-aa2b-fa3228f8c30e", "comment": "Malware payload (AgentTesla)", "value": "01a0685f1953709cf113555a93263b09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284646, "uuid": "df2931e6-11ed-4151-aaf0-0e8116323851", "comment": "Malware payload (AgentTesla)", "value": "3c32f39b40085f624b670e46aad9b762c0e379332595c13480a700c320474209", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284646, "uuid": "725341d9-5968-44d4-8972-bfbc3239f58f", "comment": "Malware payload (AgentTesla)", "value": "65da75a132337d7109c7dc2191150e2174dda001", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284646, "uuid": "bf8d8440-a781-4463-897d-d730b237203b", "comment": "Malware payload (AgentTesla)", "value": "f8d374f875666363e0c7fe8e0a89fe2dfb4db7a24fa5d2fbecb1ba0e2d27761b88609acf7760cea6098b180250141016", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284646, "uuid": "256d560d-40df-4b0a-81f9-58859266cb66", "value": "T18194A19D9C5A4C4FDC7645780B7EA21ABE36AA45D3832D3DC114BDDB84E13B8A4CAF40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284646, "uuid": "e0f35ba8-5aa6-47b4-ba64-1a8760e1c2fd", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284646, "uuid": "d7bdeddd-9ce6-443d-a79b-4e55e2cfca0d", "value": "6144:hwyYebb6PI9YBJekrgHp2pdfkLuCOITfBwfmCytb9SaJGEroJ6QpT:pYebWwyBJyApdMimZwfmpvSOA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644284646, "uuid": "6cff1503-09cf-4bc8-af38-067b5044935b", "value": 447400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644284646, "uuid": "ea88202e-0fa4-42c1-8adb-89399a63c74f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284646, "uuid": "e7b2f03c-079e-4dc6-ad95-abd8aea7c008", "value": "01a0685f1953709cf113555a93263b09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48fa84da-88ab-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644302978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302978, "uuid": "7ef37b05-3e46-426c-a74e-6c6e3cf88872", "comment": "Malware payload (Formbook)", "value": "f3f12d3364bc3b19cca3e79a989137f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302978, "uuid": "85053236-6bdf-46cf-b129-62102cb03f34", "comment": "Malware payload (Formbook)", "value": "3c3ef93ea804d5d80ecbdb244ddf7fe2ab657f54089a397f0c79d89dfef5c95c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302978, "uuid": "16780f62-f3ff-4f9a-beab-0b6053d48928", "comment": "Malware payload (Formbook)", "value": "30454ccb5adc2b97044ac8aaed0d0501b935779d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302978, "uuid": "809e15d5-bfe8-4335-ae95-29b454781d0f", "comment": "Malware payload (Formbook)", "value": "0dae0b850b1953bdc30d7c3e6e280e8319c26a67e161119eca8ee22560aeae56715d03c4991b170197dd44b149350458", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302978, "uuid": "5ba96d6e-1a65-444c-9deb-6c0347ff8d70", "value": "T1CDE1E811D7D81B37EFB70BB1A8639310E330E7519D4BDF6E6589125A3F12B900962FA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302978, "uuid": "adeba5e7-58a3-4cb3-8ac3-8e438ab8a878", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302978, "uuid": "291ae853-449c-4c6c-9ca3-673dacc1f2c5", "value": "96:3+9SFoH0i3zgzmJhulmOBiJxeY9vfl9gvp3nfzNt:u9coU40qJhYmOBQX9vflM3nJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644302978, "uuid": "932aef42-ea08-4b1e-ade0-bff613da1bcf", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644302978, "uuid": "0485bebe-cb1f-457b-8d0a-837d9607b6e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302978, "uuid": "193047b0-8c61-4d20-afe5-ecb8a5766882", "value": "Swift mesaj\u0131 4.02.2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da2873e8-88bd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644310953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310953, "uuid": "2d294880-f3db-4385-af01-d04ecdcb8268", "comment": "Malware payload (Heodo)", "value": "a06873f329f5f4b7bbb12f60ac00694d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310953, "uuid": "59ab0a8c-e61e-4cc8-a61f-12ab3701934a", "comment": "Malware payload (Heodo)", "value": "3c4513de383d429c8b86126c0b492eb55b6681ff15edf8a864b1e13fb1a7744e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310953, "uuid": "895f3185-c4ae-440b-9b25-58439d04eb6a", "comment": "Malware payload (Heodo)", "value": "de4fd73a0993d13be342924ff4868c0c0f46f9b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310953, "uuid": "58b5df54-a117-4a12-902f-e0b38635952a", "comment": "Malware payload (Heodo)", "value": "3ee068b27edf3f650296c6ea30098c5ff6ba330771ad1694cb0f35d6257c38b805e21e76338013fea866bb5ad016dbf0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310953, "uuid": "28f7c4e8-8fb9-48d9-8d16-bfc2de2cab70", "value": "T1B5F4C0006582907AE4F930B842667BF1E93D1CB0372511D39BD069FEA6E41F1B6B376B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310953, "uuid": "e2278f17-9249-4fca-be5e-8ffba639c3f0", "value": "36d18f8cb3bee16af0421e6a936157a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310953, "uuid": "96638b5c-2da6-437d-8d6e-b76107c40bf8", "value": "12288:lBseOTwOg957PAMTEFv49thrFcmxLFwD7wGcXbtzbEOpUDlBzawsoei4:keOTwOUPnTC49LJxJwaCOpUD7qoei4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644310953, "uuid": "fff1b597-331c-41ba-b7b2-173789b9e699", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644310953, "uuid": "b2604007-8388-4523-95a5-86db4666c6af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310953, "uuid": "50a2dc8b-bec6-48cf-b6b7-7502b06ebf04", "value": "a06873f329f5f4b7bbb12f60ac00694d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b4fe31-887c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644282701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282701, "uuid": "feb5e447-3e08-4d14-8996-5527bc31b677", "comment": "Malware payload (Mirai)", "value": "e00d7b7f718481b302b179fbfcdbe748", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282701, "uuid": "d7ab3bc5-c5b3-41be-b768-f98886325e2b", "comment": "Malware payload (Mirai)", "value": "3c5a37a2d8b4532c646437bcfafd961dca9c55ca05419b073b03424cef0b6192", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282701, "uuid": "188a68fb-54a1-4753-926a-0bc90af3ee1b", "comment": "Malware payload (Mirai)", "value": "7ef9d351e0308a8e94bb9a7a388a485f6eddfd32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282701, "uuid": "fe5e42dd-3c95-46b0-b95a-f5692aebebc2", "comment": "Malware payload (Mirai)", "value": "2af63931e3288a59f7aa123e4021802e828396c1c67341b6c6195def2a66070da53456f7da4c19ee6f013807ce3616ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282701, "uuid": "98524e62-1a79-4189-bd37-2c2cd234b028", "value": "T1ED633B96F8914F11C4D512BAFA2D058D371617E8E3DF72239E206F652BCA92B0E3BD05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282701, "uuid": "eb9adae7-095d-43d5-b620-8102a2ebb06c", "value": "1536:JrnN5krGZ7mWumj9WW68CNkSA5uWjQy1kBcFEHwLQlMPiw4eGR3UKo6ia10s:qe7U4XsvYusQy2BceReGR3UKoa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644282701, "uuid": "58dd1a4f-2c6f-4d86-bc6f-63f1b0b38186", "value": 72364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644282701, "uuid": "f89821b4-51cb-4b82-87e5-5db5d73a1a21", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282701, "uuid": "34ea5933-fc26-4fc1-a695-5263b9281bb9", "value": "e00d7b7f718481b302b179fbfcdbe748", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7224800-8891-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644292103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644292103, "uuid": "098db1f5-da22-4403-ba83-ebe227f062f7", "comment": "Malware payload (Heodo)", "value": "8a101db5b10e7ff6a86498243f7a1e1a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644292103, "uuid": "0e56d3ba-9480-4072-8e13-c3ca68a8784e", "comment": "Malware payload (Heodo)", "value": "3c6371f2374224a2120aa06b80bf1b6d02d131a491a378166eec5cc5e648a7e2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644292103, "uuid": "38e3995a-0497-4d59-a545-bc1588e6096d", "comment": "Malware payload (Heodo)", "value": "53af7bdc84b4aefc3da9889fb3b3123b345b847f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644292103, "uuid": "53691bac-32e3-4d78-9cee-86172c150456", "comment": "Malware payload (Heodo)", "value": "db70fceee87ff882cd0e5b747b56410818c6f0d5592a5a5bc308cd952de68f6ef8ea32844613b7e04e1cd97c09879ee3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644292103, "uuid": "01e6a036-1be0-4f6a-ac85-7d277df3a17d", "value": "T12ED38D6ABA48CA0BD94913314EE7CBF67335BC819F5297473295B72F1C3A581CA03B16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644292103, "uuid": "404f0161-220b-4cc9-803a-1667568c4dd2", "value": "3072:YcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3x:YcKoSsxzNDZLDZjlbR868O8KlVH3ske8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644292103, "uuid": "e549d364-68b9-4c7b-b036-c7f57c38c49c", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644292103, "uuid": "7f7c2b36-bec1-4c9f-9fd7-d6d55eecd6ac", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644292103, "uuid": "c74c2502-a715-46f6-abb5-30f2578546ec", "value": "tmp4645hro_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60d1a83f-88ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644339096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339096, "uuid": "d0351779-ba94-4a10-9860-e3a8a3c42561", "comment": "Malware payload (Heodo)", "value": "2045a31c3a69c761f07d782944689b21", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339096, "uuid": "d3d67e55-fb23-410e-99f0-1d79489983f8", "comment": "Malware payload (Heodo)", "value": "3c6f1c10db0379b0cd328255765df54ded6052cc47256ec7884e8c246c73caae", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339096, "uuid": "08d3e872-2d69-4bda-9e25-e3bd7c7d9660", "comment": "Malware payload (Heodo)", "value": "fa1f30b8571fe06fb19dff14186d48db2a4cfe42", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644339096, "uuid": "3800315b-39da-4927-bfa5-f11e97fbb38e", "comment": "Malware payload (Heodo)", "value": "bb94af92f73e95a2fa3fd946e2d91b195e089361ff07717b8465d5b29f72efbf4a2c32a620dad8d221a50b4bca49fb32", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339096, "uuid": "2e9e2527-86a4-4db0-8f50-190f1739a321", "value": "T159C35A55F685EA1ADE0822350DDFC7F9333ABC828E9683473299B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339096, "uuid": "df9c0756-6e0f-4114-933f-6f4f18300fbc", "value": "3072:a2cKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLB0:bcKoSsxzNDZLDZjlbR868O8KlVH37keg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644339096, "uuid": "0042e408-0714-4c0f-b2cf-acd4802ad29e", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644339096, "uuid": "c9587f2b-8cfe-4788-b1c8-300791bd6992", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644339096, "uuid": "586faaaa-c010-475c-ad8d-43428b7e19c2", "value": "tmpkfsul9ag", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ca3407c-887a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644281966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281966, "uuid": "4cb0313a-ac3b-484f-b31e-f652c08f48d9", "comment": "Malware payload (Heodo)", "value": "af6f72f7f6fe40c832a327ca7e3616a5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281966, "uuid": "10562816-4799-457c-b307-c7ba2b482aac", "comment": "Malware payload (Heodo)", "value": "3c7ce9185e4208cc8f35aa83111418772f8a0d30613e28f48c8f18ed9ddaee31", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281966, "uuid": "f5041de0-dcbc-45d5-af5b-fed4ea0c9d76", "comment": "Malware payload (Heodo)", "value": "6eec409653e155d256c7068361bc342c169f10d3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281966, "uuid": "ee635433-66cf-47b5-b5f3-82e9abab5ffe", "comment": "Malware payload (Heodo)", "value": "19b7d2275c61a38c8269856547b086c994622114d3c0858a8ae6a6b3c664195bce25556ff5c67f217e6e9804d158e326", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644281966, "uuid": "61d06747-f46d-4f49-9907-f47ce27a3063", "value": "T1A793E15D6E5C6D0BE1D7E339DF38DE6093252C8072A3B4B961617FA9003D493C1AAE6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644281966, "uuid": "235f661a-692b-4ee4-8ccd-c8ee9c93706e", "value": "1536:zZRiRVqrgQlDRXm8SKa3Xm1WBXz7yL64i+kkfa+3gtfvjHtoxzg5bjIFeTd:zvAVqJlDRWsa3Xm4nC5X5gxvhoxzMIEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644281966, "uuid": "72a29294-f8e2-4ef4-8ab5-b3a81ff0b11f", "value": 94231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644281966, "uuid": "a1aab45c-4eb4-4a3f-bd5f-fe6603a62f98", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644281966, "uuid": "c6730906-a413-407d-ba45-3a4ea9024190", "value": "tmp_20rh811", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883f4724-88bd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644310815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310815, "uuid": "a894ca04-d0d0-4cff-9e08-726bd4394b01", "comment": "Malware payload (Heodo)", "value": "d58552ce47559b609ee1ed78964bd69a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310815, "uuid": "f76857bf-1bc4-46ad-a90d-7b84351b9f74", "comment": "Malware payload (Heodo)", "value": "3c832d8eda9d07c28072ed0613e89f2591805fba29181c69b8290e4beb1e6715", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310815, "uuid": "aa5e60fd-be30-419f-8711-ac4b83a203b1", "comment": "Malware payload (Heodo)", "value": "073f8eb308fa69a37b4b8147daa0963383dd3b0d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310815, "uuid": "52b48d90-61f4-4f34-a26b-b81ed6480173", "comment": "Malware payload (Heodo)", "value": "1f301e422fbccdcda9e710f031a20b5ca60c368c6d12183139c021680afefca85ed5d6343e5ff0a065eeee7a5ce0fa5f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310815, "uuid": "7edbf9db-a207-43bd-8039-41e81869202b", "value": "T132C36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310815, "uuid": "4c5b372e-8f98-4f07-8a40-28fa41e0024c", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644310815, "uuid": "dfda3b9f-856f-407d-9150-8023374e7209", "value": 127573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644310815, "uuid": "a9b012ed-4c65-4a22-8392-7e5485465e51", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310815, "uuid": "c9624d51-6333-4b7d-b43b-77209d4c7e71", "value": "tmpozgtzmo2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e16a27a-8905-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644341749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341749, "uuid": "c5d6c6ce-6af9-48ee-ba4b-cccb79b7de57", "comment": "Malware payload (Formbook)", "value": "47143508ac2284290a34022429fc56c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341749, "uuid": "611b4a95-02d1-49ef-a350-f474ee36f554", "comment": "Malware payload (Formbook)", "value": "3d1c26a55a0b7a502b019b18f4b6e87c1273d3c42a50d20c958d510f530c5f40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341749, "uuid": "11b6ebf1-7a08-4263-9679-2168e3093069", "comment": "Malware payload (Formbook)", "value": "927650a2f64930dc31f16e1a8e931dcaa332a7d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644341749, "uuid": "1c10ef86-df36-4c36-a4b2-39a5475f4830", "comment": "Malware payload (Formbook)", "value": "74aaa3046e283d8aaf9e0bb44453b94ab9be48b13d841dd95dd7b8caad467b4ec70f47812a0009a58e3574585c6c5e48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341749, "uuid": "d50e1aac-8cea-42cf-b685-b9af26177883", "value": "T10F23E741E6AA0367D65687F2B49346C31BB1600E58E0CE6A9CC930DF19EF7156583FCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341749, "uuid": "29f2682c-e0f1-4f71-b749-1a501bbcfec9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341749, "uuid": "e80d9ca2-0021-4ca7-ad1a-5703c2c838e2", "value": "768:Exhavl8zdEZDpAgka/8HHUTQQQQQQQBdy3bI91GN6bcE/2ihWSCAtkrjL1Fn:4h0Dpga/eHUTQQQQQQQBdBgN6b5/2kW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644341749, "uuid": "4af22aed-4d3e-4192-8c37-3d1b51cd452c", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644341749, "uuid": "3f3ddd57-0478-4a74-ba06-803844544056", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644341749, "uuid": "623a5cdd-27a7-45b4-9605-2605bab84e2c", "value": "TNT Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94536a93-88f8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644336176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644336176, "uuid": "fd38ab38-8d4a-4997-bf7c-6697d563bad8", "comment": "Malware payload (Heodo)", "value": "2d32de10f33975eca2dc8d500a40c526", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644336176, "uuid": "a7b6d0c1-fbaa-4382-bd15-816a57f3d2c9", "comment": "Malware payload (Heodo)", "value": "3d42da4dcaab7651baeb783c8885c547285320d2af340deefbd0d9a724dbf7d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644336176, "uuid": "ab8e9f50-69e4-4d56-ad59-25c6cc33a7c2", "comment": "Malware payload (Heodo)", "value": "ad6cc0f1329f212e00ad13a9ccda11e9b57b55c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644336176, "uuid": "1883a155-f2f8-4599-8019-e6e642a736c6", "comment": "Malware payload (Heodo)", "value": "cad10d5759ab4b0dc539c760ef2911670391031d02ad687a7d4f27609174e10d84e990ae2b8a27cbc8dd096b67a04a49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644336176, "uuid": "bc720b16-6a07-4fbf-ae9c-c5f32a0e3319", "value": "T1E4F4C0006582907AE4F930B842667BF1E93D1CB0372511D39BD069FEA6E41F1B6B376B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644336176, "uuid": "e289b171-149d-4454-a67c-a479974bdced", "value": "36d18f8cb3bee16af0421e6a936157a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644336176, "uuid": "d571376f-7356-44cd-afb7-b228a653d00f", "value": "12288:lBseOTwOg957PAMTEFv49thrFcmxLFwD7wGcXbtzbEOpUDlBAawsoei4:keOTwOUPnTC49LJxJwaCOpUD7Toei4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644336176, "uuid": "7056bb49-4a27-4dfa-908d-ac387b74cd31", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644336176, "uuid": "013300e0-51c3-4049-9855-af908f806052", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644336176, "uuid": "223507a1-f506-4555-b2cc-a54b8a93adbc", "value": "2d32de10f33975eca2dc8d500a40c526", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13bdf8ab-88b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644305036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644305036, "uuid": "b0dad21e-4e59-483f-8eb0-28c1c32cc02e", "comment": "Malware payload (Heodo)", "value": "09810c1e32d2f661d73491bf9f43e9a7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644305036, "uuid": "3026488e-ccb3-4580-bb1b-3ced3a41517d", "comment": "Malware payload (Heodo)", "value": "3d79b76524df4682f840b4606d8d75de43e5cf1272044b1de43aad0ce6d0eb98", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644305036, "uuid": "e5dd2eb6-7787-4aab-a04f-f3f5782ffe1f", "comment": "Malware payload (Heodo)", "value": "d34bbbb0df96411128e98345b24af14ba487c3b8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644305036, "uuid": "9d39ef5e-0e49-4ab2-b95d-8c1ae591500d", "comment": "Malware payload (Heodo)", "value": "6e8a78a06630ef17c08eb6d8946b5dca09418dacca9ec863d4fa6bbd774c19f6dce05305de1e09c4486e112748d6b546", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644305036, "uuid": "df9f754e-f1aa-4212-baef-0f4095ca2568", "value": "T15493499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644305036, "uuid": "dd91e183-3ad1-443a-9efb-c8a842820b7a", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644305036, "uuid": "8da7dc5b-fdc8-46c3-a97f-5f00f0f8622b", "value": 96586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644305036, "uuid": "4c585582-7421-4fbc-8a28-dd9c805efce8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644305036, "uuid": "d5793f43-ac5f-41d4-9497-1d85c00807e6", "value": "tmpofmkxxxx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee22b54-8927-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644356246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356246, "uuid": "086212fb-df51-493e-bd1a-d45ef22dc01e", "comment": "Malware payload", "value": "21a7c5a3e4c8190104091bd3d3e55256", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356246, "uuid": "df999751-a68b-470d-ad42-6e59fe65a604", "comment": "Malware payload", "value": "3d83bf48b5f79e5e37ba025d26208f16dd56379959de95d0f82a01340c8dde1b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356246, "uuid": "6fbf2fce-7142-4f82-b122-8b29d209d456", "comment": "Malware payload", "value": "9808ab4783c3d370e49b1bc2c74f16e70d1769e9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356246, "uuid": "39a0a224-a55e-43d5-86c4-1a0b8b089a21", "comment": "Malware payload", "value": "d3744d712f72f28435a2c229cddd6c3ca9ed13f3ac429afd64c611b973a022c57d1b0ff577b0dee7eaf357e587697131", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644356246, "uuid": "efa5479d-3038-4be6-b43e-3f11172e05ab", "value": "T15EC35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7C76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644356246, "uuid": "93315043-2dd4-4551-b9e5-22719da4f3c8", "value": "3072:KhcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBF:kcKoSsxzNDZLDZjlbR868O8KlVH37ke9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644356246, "uuid": "a00382eb-619c-43ff-9693-a6185fb1637c", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644356246, "uuid": "c8cf7ae1-d78d-4aa8-af36-1ce80d344064", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644356246, "uuid": "d6762b28-2f97-4817-adc5-a7205572f4b9", "value": "tmp50yueuyf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4813765-88b3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644306648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306648, "uuid": "0a5e237c-de27-4e64-83c9-c218122dfddc", "comment": "Malware payload (Heodo)", "value": "5214b4c5057f17825e54bd56a8161b38", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306648, "uuid": "fe6e64e3-e271-4054-ac7a-337ade6b72b5", "comment": "Malware payload (Heodo)", "value": "3dab735470a14080f64fc0434cf251dfabcf85a51247a8f67844d57758e1f68d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306648, "uuid": "9c7f368c-f180-4f14-9185-9693587ab216", "comment": "Malware payload (Heodo)", "value": "06503b363344a99db429941459b5c1d4f101ebbf", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306648, "uuid": "51d5074f-bbaa-4f1a-873e-5ce8c9062106", "comment": "Malware payload (Heodo)", "value": "6bb5b0f415c74aceb0679eb58c2bbe8bdba3606f40f8707cd4e8b69502208ec600da26a409455e18dc02e865da5d8c8b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644306648, "uuid": "06d57cfe-8e5f-4dd5-a74b-9a5bc7ef420d", "value": "T13493499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644306648, "uuid": "7b11f2f3-47ac-49d6-b486-93a201136d73", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644306648, "uuid": "7f2e9926-2ca3-4018-ac6b-f20010158e56", "value": 96348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644306648, "uuid": "f3de0289-37ff-4208-9cdd-375a7e39d74d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644306648, "uuid": "3545c77c-091a-4410-9eb1-c4fb7d2a59be", "value": "tmpv60qacyc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9915d088-891b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644351216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351216, "uuid": "fe1586c2-e015-4b60-bd3e-392c725a5160", "comment": "Malware payload (Heodo)", "value": "4c88047879489de708b2c340be4bd3d4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351216, "uuid": "d638feed-23b8-454b-bc34-71884ee20f28", "comment": "Malware payload (Heodo)", "value": "3df0e6cbabc4c5fc4479814bbec442963812d34d6db11b5bcde4e7a967f0108b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351216, "uuid": "5afa340d-64f0-4825-a164-e8b21ccbc17f", "comment": "Malware payload (Heodo)", "value": "a3d7899deab6935bec02fbb88f1cd37e4e310268", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351216, "uuid": "260e8cab-9457-4924-858a-72ac1725b54c", "comment": "Malware payload (Heodo)", "value": "5922872c894e77efd10e2a5117f88a4c5dd68c71320ddf94a49653d986165b9d53e1c2c768615108101dc7db2b7df180", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644351216, "uuid": "55045b89-82af-4360-ba51-4600cdd89257", "value": "T12EC35A55F685EA1ADE0823350DDFC7F9333ABC828E9683473299B32F7C76550CA12606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644351216, "uuid": "c784d458-dc81-4f1f-97cc-458e181522d8", "value": "3072:f5cKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfB1:RcKoSsxzNDZLDZjlbR868O8KlVH37ked", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644351216, "uuid": "ff96899b-c44a-4f30-b716-12d71c4ce9f9", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644351216, "uuid": "c568b60c-2f3a-4b4e-aec7-88e6a4fe9c07", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644351216, "uuid": "c441d228-990f-440f-85b6-8f72520212ab", "value": "tmpqnuywwco", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d378cd2a-892c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644358616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358616, "uuid": "78c25123-a6bc-4545-8be1-7903fb1ca6ba", "comment": "Malware payload", "value": "4bc1fe8dfee44c95d27dee26fe755793", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358616, "uuid": "cd8fd5c6-6fc0-4cdb-b19c-860c84c04a4a", "comment": "Malware payload", "value": "3df9aec4a232358fd54a496fef0fbf8e6c0cc4928ad6d7de138459de3e863065", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358616, "uuid": "be6a2928-17e5-4e5a-a80b-949a7c9a9462", "comment": "Malware payload", "value": "84c921aa3f6d4d8a100cc09bf83a64371db729f6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358616, "uuid": "fb3ccd29-d248-42e6-8842-5a79e72e4eb3", "comment": "Malware payload", "value": "49c31236899a4cffaf31806da2b54cb3a01fa573b941c0cbff4288cf00695ac3034b382bb54ca1e8e4500fabd37a2900", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358616, "uuid": "f59ea331-d2ac-4e30-90aa-2401492c55ec", "value": "T1DCC35A55F685EA1ADE0823350DDFC7F9733ABC828E9683473289B32F7D76550CA12606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358616, "uuid": "d8f3fd10-7b7d-4a95-8042-cf1bd5dcedfc", "value": "3072:xScKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBU:gcKoSsxzNDZLDZjlbR868O8KlVH37ke8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644358616, "uuid": "1c19d094-3bbc-415b-92ee-e0fb08393b22", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644358616, "uuid": "5ed2da3b-220d-4d47-89b4-8dadc0bd95b6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358616, "uuid": "65e37a07-fc19-4036-b881-f40a119e64a6", "value": "tmpt_wer16u", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07209a3-887f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644284361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284361, "uuid": "fff0ce8f-a5ba-436b-ae3e-ff6f53c0eac6", "comment": "Malware payload (Heodo)", "value": "c1f81305732b75d2b890fcb31b69b672", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284361, "uuid": "ab888b41-cfc9-43e0-99a8-2ab450ddc66a", "comment": "Malware payload (Heodo)", "value": "3e0580f16891a07cc2b4c9e8152d4d9838d23769c546897d161f9ed25276074a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284361, "uuid": "c600ec6a-e87a-435f-9181-0382f2b1891a", "comment": "Malware payload (Heodo)", "value": "615cd56aad94133e31f4a8f3162431194a85bc59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284361, "uuid": "7c082e93-603f-4c17-974e-f9aa556478ce", "comment": "Malware payload (Heodo)", "value": "e4754bf7021959d2fc036ca724be00f7b21025be57d38fa2e075d8c139d64c4644b78cc0b1bc3de431034181d145bf52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284361, "uuid": "efa7502d-32ea-42b4-add3-b08540c8e306", "value": "T120D429AB3A8FA1BDF17B017A6350FB44E4D27C1A9FBD25D70A86358893F2D054F18A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284361, "uuid": "19cfcf77-e31b-47f9-b722-f50902fd8290", "value": "bf1ebe22ec6f51f906ec295a3a5c6d92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284361, "uuid": "0580b0e8-436a-460e-aebc-e0f0bdf8fb0a", "value": "6144:x42k6LwFPw91EDbkUE39P7pyADYzqlEDFmZ4s3wADmcvIpxUIVZFoEXlbeZhp4ga:x409qDb109PdyOYzq3c3fVbeFTi40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644284361, "uuid": "f216ad89-594a-4dfd-90f2-8dfb9cef57bb", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644284361, "uuid": "014e963c-af55-4ed4-91e0-6deff546f8be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284361, "uuid": "815c95b7-f8f7-45c5-9538-ac4b31a62200", "value": "c1f81305732b75d2b890fcb31b69b672", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e813908-88be-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644311121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311121, "uuid": "68140640-ce1e-4a70-8efc-c2424a62123b", "comment": "Malware payload (Heodo)", "value": "28060541713825db98de6eb34262cf81", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311121, "uuid": "1f650374-06c4-41a4-aab7-acf7bfd9d7d9", "comment": "Malware payload (Heodo)", "value": "3e24e40b62f4d4e77e5bc6e77c5fbaca1882358d5b6dcc42dcf127e2bff16c5e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311121, "uuid": "f89f1cae-7789-4db8-8ae7-99648b08e1f3", "comment": "Malware payload (Heodo)", "value": "8bb1b169456a4f978708005bd1c626e0f9edd5e2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311121, "uuid": "517adef1-e0b0-4a20-adaf-37925c3a2a02", "comment": "Malware payload (Heodo)", "value": "727264f90d2ed6095af556fb48da234d347d69ceb525c4ba4c7ecbd045e3256e801b2d271c60017065d8aafe439a4d01", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311121, "uuid": "fba0f1c0-aaab-4258-9d86-c845b2e2a117", "value": "T199C36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311121, "uuid": "d4320624-16cc-4aa5-bfe8-bfaa9106a0c7", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644311121, "uuid": "9a9e5473-12b7-41ea-8931-93aeb0d50275", "value": 128328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644311121, "uuid": "72d3504e-1893-401c-b98c-9c2f841228f2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311121, "uuid": "91ba361b-7d14-4a8c-9398-b9d0dd22d810", "value": "tmpi33a443i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee67b6f1-887f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644284358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284358, "uuid": "17f5f388-913c-4904-881f-78cab24ca3ab", "comment": "Malware payload (Heodo)", "value": "678a53aa361b9a48b3508caa7289c55d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284358, "uuid": "3d4f3d66-1a50-4472-8bf0-749f511332b4", "comment": "Malware payload (Heodo)", "value": "3e53d7e1bbfe518d4741d86ed70db7a55a8f5143aaf3bcfdb2ee140337a5ddc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284358, "uuid": "d5e94b61-eb0b-4e9e-afd2-72e7cb3423b6", "comment": "Malware payload (Heodo)", "value": "10d6a2ac53564a74670e51d52ed45e88457cd920", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284358, "uuid": "1d6bba06-4c79-47f8-a055-fc3d4eb78181", "comment": "Malware payload (Heodo)", "value": "a269cd98869822e2918b5b8b6909137f2bcef89d2367b32e7420526e72c1bf8f044e5ddb5f796b075b9d2d7ead9dbc90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284358, "uuid": "c0617dc4-2c0f-4a45-824e-f820c2bb17b8", "value": "T1ECD429AB3A8FA1BDF17B017A6350FB44E4D27C1A9FBD25D70A86358893F2D054F18A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284358, "uuid": "cdc6f19b-dbb7-4c38-9c07-33664fe683d9", "value": "bf1ebe22ec6f51f906ec295a3a5c6d92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284358, "uuid": "247f4da9-9c80-4017-a93e-b701ee855835", "value": "6144:x42k6LwFPw91EDbkUE39P7pyADYzqlEDFmZ4s3wAD8cvIpxUIVZFoEXlbeZhp4ga:x409qDb109PdyOYzq3C3fVbeFTi40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644284358, "uuid": "94f3aafb-f90c-480f-acc0-f8d58c7a63ab", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644284358, "uuid": "eb034001-45ee-4a59-b327-e5ec35882be0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284358, "uuid": "559b7459-9733-4390-8368-f85904ac6369", "value": "678a53aa361b9a48b3508caa7289c55d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ac7b27-8897-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644294678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294678, "uuid": "cd163b26-3f7b-4efb-9f38-13936f58f75c", "comment": "Malware payload (Heodo)", "value": "2392c3f13eef7cfdb120a962cfefd8fb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294678, "uuid": "10cf8e02-b5d9-40a1-9577-8c0dc8efa8b7", "comment": "Malware payload (Heodo)", "value": "3e941bd829a7af7ee99daa34c4112e0711f1ae24a82c10964410a8506e9558d9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294678, "uuid": "8416595e-e479-4991-9cf4-6fe1aee0063d", "comment": "Malware payload (Heodo)", "value": "92ad159f9417b75229700730f1a4e659ceb0a77d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294678, "uuid": "36f7a9b8-bfff-49ff-9cec-a239ee0c2d02", "comment": "Malware payload (Heodo)", "value": "2106b1a1a7fcaa1911d85045bfdc02484c8d6989521c3fff968cbad5695f822f71918ebefaf26c651016298f3544f70f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294678, "uuid": "a903500c-47d8-4881-a230-29a30aa7861c", "value": "T12ED38D6ABA48CA0BD94913314EE7CBF67336BC819F5297473295B72F1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294678, "uuid": "db7b7dee-94b1-4f76-a65b-a463183e383a", "value": "3072:kcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3G:kcKoSsxzNDZLDZjlbR868O8KlVH3skez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644294678, "uuid": "c85dc2f0-1171-485e-9d0f-301be810a73f", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644294678, "uuid": "b57dc194-88de-430d-8d2e-77e789bb985f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294678, "uuid": "3a533bc0-2f5b-4353-8c75-fd7bdf69dc05", "value": "tmp8u9jumt9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e376903e-8939-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644364226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644364226, "uuid": "68041633-3ffd-42ea-89cf-c77574bbc3a9", "comment": "Malware payload", "value": "31e8fa6fb7d60040a818a5372f11e427", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644364226, "uuid": "496b16c0-2d75-4e7b-8ea5-f9417a8235da", "comment": "Malware payload", "value": "3eb58c13cf494d1dfc83cc80d25e5cce61290230094a998a321b1147f867473b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644364226, "uuid": "4f6e8dab-38cc-4455-a739-26acdda98435", "comment": "Malware payload", "value": "9f482a6fd9f692b663bafafdbef1ba1d794135aa", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644364226, "uuid": "1224f1f4-4a2f-4367-9c07-5af784ad3db2", "comment": "Malware payload", "value": "0f34efe0091de583315180d885e624d7a6878c5bb95d0bca4f4c983ecaad28e2ffeb6cdc718a2fcda0449d2a2da0fc51", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644364226, "uuid": "381b199e-bfa7-43d5-ac87-8aa4a1682426", "value": "T1B7C35A55F685EA1ADE0812350DDFCBF9733ABC828E9683473249B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644364226, "uuid": "de82204d-e711-48f2-8483-b0beb005da80", "value": "3072:b/cKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBD:7cKoSsxzNDZLDZjlbR868O8KlVH37ker", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644364226, "uuid": "5fdacc3b-3c1c-4ecc-9437-3de19d35d7d7", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644364226, "uuid": "0d25329a-319e-42e7-9a07-9e69bfa9a914", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644364226, "uuid": "a7cbc3f9-dd07-4c74-9974-e9508d4e2f39", "value": "tmpga6gt9j0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcdf1991-8877-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644280839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644280839, "uuid": "5f55b92c-1552-4b36-9ede-eae16a852847", "comment": "Malware payload (Heodo)", "value": "04533a2fbdca6ab1b3040dee13769285", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644280839, "uuid": "77efc2f2-b015-4db2-9e78-476c8fc01796", "comment": "Malware payload (Heodo)", "value": "3f658ba49b52b62a8aa9533145ea555abbf24ce9180f71c2a33504b53001a7ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644280839, "uuid": "96f7ed15-978b-4723-85a0-0c4b12ac9cc8", "comment": "Malware payload (Heodo)", "value": "92f6a29a0d4e4a083158b5a05f3d6fca854be131", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644280839, "uuid": "244b4f32-d5f0-4d96-94b2-304670e4f7ac", "comment": "Malware payload (Heodo)", "value": "611470802fa6c2e44e40d7adc0cfa258fa64d4af2c9c4f89808d0c5349db7c0141ecdb98eabce9a99d013c2a70400650", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644280839, "uuid": "d9420dcd-23c5-4b08-9a37-01ee50831675", "value": "T18CD429AB3A8FA1BDF17B017A6350FB44E4D27C1A9FBD25D70A86358893F2D054F18A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644280839, "uuid": "976fa82f-8ad0-4845-88b5-053b191a9175", "value": "bf1ebe22ec6f51f906ec295a3a5c6d92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644280839, "uuid": "e8197fba-cd48-42a2-b11a-548a8d17b75e", "value": "6144:x42k6LwFPw91EDbkUE39P7pyADYzqlEDFmZ4s3wADccvIpxUIVZFoEXlbeZhp4ga:x409qDb109PdyOYzq3i3fVbeFTi40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644280839, "uuid": "fb989d5e-6af1-4eed-a1d2-93a5c9efd38c", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644280839, "uuid": "0da768f6-b16b-45ae-bec3-fd9200e63c97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644280839, "uuid": "7a35e86d-91a3-480f-b202-fe453b4d02ff", "value": "04533a2fbdca6ab1b3040dee13769285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b647215d-890d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644345252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644345252, "uuid": "35cfd123-3260-447d-a300-1f34f754a5bd", "comment": "Malware payload (Heodo)", "value": "09036f5c1f2262e4c8a50c3c93de9cb5", "object_relation": "md5", "Tag": [ { "name": "5", "colour": "#9EC247", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644345252, "uuid": "b13327fa-57a3-4ca4-9fec-4f3d04654963", "comment": "Malware payload (Heodo)", "value": "3ff447f351de7c11bb38df2320357913c5e3dc438fca4d33dd8792fe860ad3d3", "object_relation": "sha256", "Tag": [ { "name": "5", "colour": "#9EC247", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644345252, "uuid": "122bd2f4-06e6-4fb7-9685-d46bf2f35798", "comment": "Malware payload (Heodo)", "value": "3f5fbc218f28ed667ac54c5e1cf45f964a68e1f8", "object_relation": "sha1", "Tag": [ { "name": "5", "colour": "#9EC247", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644345252, "uuid": "7a7f347d-03b5-4288-ad66-b840296fe559", "comment": "Malware payload (Heodo)", "value": "bb2d8361049ad2621dca351b1a62f038aa9c5bee38a7da43c723f349ade3170a1265c865ab97eb649c4b9adda19f94dd", "object_relation": "sha3-384", "Tag": [ { "name": "5", "colour": "#9EC247", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644345252, "uuid": "60a8f233-e2dd-424f-83e5-52d73775d269", "value": "T127C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644345252, "uuid": "a296c085-8808-45c2-96d2-f78c8778b2a1", "value": "3072:prcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgiBQ:1cKoSsxzNDZLDZjlbR868O8KlVH37ke1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644345252, "uuid": "67f4bbca-367b-42e7-a709-ad3ca4148127", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644345252, "uuid": "1e06ae68-df24-48d5-84c4-c232875995a1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644345252, "uuid": "660c19fe-ce06-4f1d-81d3-0a5885e0e86c", "value": "tmpt9tu0ezm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b126b2af-88c8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644315608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315608, "uuid": "9ceb1143-009c-4721-a4f2-78747dbce539", "comment": "Malware payload (Heodo)", "value": "45f7ada63015f9717d3b498692df0ed5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315608, "uuid": "6d7f5ae4-fce7-4738-9451-d5ba93a24f18", "comment": "Malware payload (Heodo)", "value": "4015e22eb965e9c1ba13a24eeeb905cd65b975072fa0b657df17fd27caed6b1c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315608, "uuid": "8b426268-41b7-4830-a9e2-3a67621916c0", "comment": "Malware payload (Heodo)", "value": "9e6f83d5c8e878a43f738395fa8d5d627e68a7c3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315608, "uuid": "ff180d73-492b-4c35-8c64-1d3a4b79e98e", "comment": "Malware payload (Heodo)", "value": "73354779aadfdabfbee72fa35501193443bd61e4fa9d81e9aea3d5d2c627af4b32c3276eb5f8ea43790436fca71bba94", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644315608, "uuid": "5b71e16c-f539-4811-9c77-60c1275a81c2", "value": "T19593499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644315608, "uuid": "584c102e-02f1-4791-a313-71e5d90ff0ab", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644315608, "uuid": "58c19053-9ae3-4d03-9ec3-e22ae491a70d", "value": 96833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644315608, "uuid": "5e8b82b7-60c9-4d5b-92c0-2751be9c2785", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644315608, "uuid": "4841432c-664b-485d-8a31-a4cfe94d6329", "value": "tmpjp49iv2q", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4338c6ad-8878-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644281064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281064, "uuid": "7796236e-bc23-456f-99de-8377d350c787", "comment": "Malware payload (Heodo)", "value": "579111cf352fa89b3e57ad34ab8f4eeb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281064, "uuid": "69701b5e-4d39-45ef-8812-6bb8a0f39d4c", "comment": "Malware payload (Heodo)", "value": "40805a614d7767444aaf1f55db3e43d4ccda20096fb5ee84cf0dfa53bc777b2b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281064, "uuid": "fcf9e5fc-5e96-4ac3-93d1-28b88ef07c50", "comment": "Malware payload (Heodo)", "value": "d30f39dc612e8f44e03f721476b52c52a7044a8d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281064, "uuid": "622aba34-0a38-4ef7-b1c4-3132e539c423", "comment": "Malware payload (Heodo)", "value": "f3ad18d7cb2fa313198f4475bacaa044a28882085e5286b86953cf68f67e3bd7485c3a6c7b8e9563d8b00d183933c6b9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644281064, "uuid": "5a07e5aa-8e90-4329-8cb3-8593ff165809", "value": "T1DF93F26E6E1C6E07E59FF238CF3DDA6082141DE06662F47960B16F79403D493C16AE5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644281064, "uuid": "f84e7fbb-8af7-4ae9-b9f5-9777f578d2dd", "value": "1536:zZRESskymc9M1wXSSKa3Xm1WBXz7yL64i+kkfa+3gtfvjHtoxzg5bjIFoCMU:zvbslXM1wqa3Xm4nC5X5gxvhoxzMIeCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644281064, "uuid": "14887dbe-b115-47a1-9915-022d1716f960", "value": 94224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644281064, "uuid": "f14452d6-833e-42a2-8710-fb494b3e0b82", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644281064, "uuid": "f512ddff-26ce-4120-ae20-8d056dc2c7b6", "value": "tmpml5zecgy", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e3c326-88de-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644324827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644324827, "uuid": "b20b88a0-1dbc-4196-a944-15757ec52dce", "comment": "Malware payload (Heodo)", "value": "b7e9a86c6b9b71d6cb2723c22cfd753c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644324827, "uuid": "a2a0d8b0-07d3-4161-beb5-ce4f8bb6d862", "comment": "Malware payload (Heodo)", "value": "40ad1404cb6bc4214e6e94645444b9ebaaba8d24a13961cbff612c3343981550", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644324827, "uuid": "dbae171b-995e-4933-8b83-9c34d63d3686", "comment": "Malware payload (Heodo)", "value": "a0f85f834d5c245e7481090a4e7be630643b9bfe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644324827, "uuid": "572865fe-0fbf-46f4-9968-8ed2820d8fbe", "comment": "Malware payload (Heodo)", "value": "97038e850dd8c3b4306b56a6a3b37cab1f19c2b0fb3f8a60331ebca11a302d4448b76c9d20f234fc7dd4f4f3bc818ed1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644324827, "uuid": "4c7be99a-49bf-4cf8-9898-68faee334c38", "value": "T1EBC43A12AA82B0F1C79C813EB3F97AEB903F146547AA76D34FB18C8965EC0D119F7911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644324827, "uuid": "1b8a5bdd-2cc2-4947-a0f9-fe6d105d3137", "value": "1059dec3a72d4c311e39c8fc33d5af98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644324827, "uuid": "030afc47-4598-4d0c-964b-a24e938bb00d", "value": "6144:PQXvqLl4JINqB9QqbJq9AbuR/RzZ+fRbc96lnVPk5XtlOkiETHyROnR:oXvQDQVq9Ac5ZuR+6lRkzloEzyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644324827, "uuid": "f9388d62-8a2e-404d-b5c6-1a1d72047e80", "value": 596992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644324827, "uuid": "81cf4bf8-1b22-4dc9-b55d-772db762e3a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644324827, "uuid": "eafcc09f-9999-4e01-a428-d4f746d9791c", "value": "b7e9a86c6b9b71d6cb2723c22cfd753c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca7d057-8930-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644360242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644360242, "uuid": "d866907f-1cd1-46a0-a85f-7da45e4e76a3", "comment": "Malware payload", "value": "527c95e823bc0faf5aff47e26b84a82f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644360242, "uuid": "5c85d631-f10c-4692-abfd-1bd4b711ace0", "comment": "Malware payload", "value": "40b8282dd416f75a4d8827d2043f5a2e33a121b00998b50270caab5f6cd4887f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644360242, "uuid": "6bf2220f-2617-4792-a1ee-91ccf5bbd182", "comment": "Malware payload", "value": "89748c7b67f7503a81938a59d2a286ee07f8ea55", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644360242, "uuid": "d6949f8b-0742-4fbd-96cd-2c39ee3845b9", "comment": "Malware payload", "value": "f12ccd9422961371c947823b87cdaee48ac83d2946bf1ffd1515d2fd83ec51e2d76303985978a6a6a0afefaee8c8fc9b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644360242, "uuid": "b90948fa-f3fe-4bea-91e7-32084e3b2d69", "value": "T1ECC35A55F685EA1ADE0813350DDFC7F97336BC828E9683473289B32F7D76550CA12606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644360242, "uuid": "badc46f4-6c7f-4539-9ced-0ece40151d24", "value": "3072:NKcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBM:scKoSsxzNDZLDZjlbR868O8KlVH37keU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644360242, "uuid": "52535d17-3b5a-46ed-a69b-28e3532955dd", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644360242, "uuid": "d65375d0-65dd-4100-bd6a-2c7d89809d93", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644360242, "uuid": "78fcbb57-4b72-4001-a348-09b4d36341f5", "value": "tmpqygmmg4o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e46e509c-8910-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644346618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346618, "uuid": "74a430d7-b7c9-4095-8b07-192c0948efaa", "comment": "Malware payload (Heodo)", "value": "90746ad6b951beb81fcef84c9afbaf4a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346618, "uuid": "38f9b0c7-ed56-4e4a-b30a-6e6cbcfd98fe", "comment": "Malware payload (Heodo)", "value": "40bb179db4c0de32c64ea810c3f8fbe10dc3cac14b64e0f78540265819d26aa7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346618, "uuid": "ebda257f-06a3-4216-9438-c8f099af7888", "comment": "Malware payload (Heodo)", "value": "7131c66e2e75f6bbec2843366ee30f033a485f72", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346618, "uuid": "0efd6698-0da4-4c6b-a371-6a586ffc5969", "comment": "Malware payload (Heodo)", "value": "15e3bef0b66781a3f6a25c3cc0236a4e5275b9aee4ecef845644e2dfda1d9e1ebe5db9764bbacab15177d58b71a1ec96", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644346618, "uuid": "16806bb6-1e08-4990-b5c5-e00495dbfc8d", "value": "T1C2C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644346618, "uuid": "e95dcbae-a109-49fc-a2d4-486e6f88812c", "value": "3072:E5cKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dg3BP:+cKoSsxzNDZLDZjlbR868O8KlVH37kef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644346618, "uuid": "4586df7b-c65e-4141-9fe3-baae2c9a71d0", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644346618, "uuid": "4e453ba2-98fa-4d2e-8f29-3b1fd6655668", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644346618, "uuid": "e724fc7a-9b91-4865-ad54-7dc34bd89df1", "value": "tmprk8c74rb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462b7d50-887f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644284076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284076, "uuid": "66a3d209-2e75-4abb-ab76-cdf754f655b4", "comment": "Malware payload (RedLineStealer)", "value": "f68f4f7d654f7cb8a57e6715370d848f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284076, "uuid": "1de49754-b605-4ab7-93ef-5bb7ceee98d3", "comment": "Malware payload (RedLineStealer)", "value": "40ccb9d35231209bd14eed10ec6d6574d464f0dcd98da8584e02dd91c71a4b6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284076, "uuid": "0a722616-953a-4c9d-b688-e431a5fa4381", "comment": "Malware payload (RedLineStealer)", "value": "25bf3097e46597385a76be4bc73fd7aa852146a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284076, "uuid": "e020c41c-b289-47ed-a8b3-8ab929634511", "comment": "Malware payload (RedLineStealer)", "value": "c4eb2304812baf35a5190cf6e7edbcff834718559b441a52448afd0ec932148ba68bc6b3422f80387d9b0310667ba856", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284076, "uuid": "2da59b0a-dd03-4984-b6fd-c6f99d699bbc", "value": "T101448C00BBA0C035F5B712F8497A93ACB92E7AB15B3455CB63D52AEE16356E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284076, "uuid": "454cc5ed-4cf2-4a6c-bf33-4efde30cc91a", "value": "63f9a18a26e146489d4459889103d05c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284076, "uuid": "92d3c325-a7bd-47e7-b955-3b73ebe4213a", "value": "6144:lzsWPCF1aka/kf1bySaGrZjudmjUyDmUau2stAlK:liF13m+FyG5udmjtDm5tst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644284076, "uuid": "151d80b6-2633-4dc0-a089-515500383abc", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644284076, "uuid": "aa33050a-f803-452f-b7f4-be974b1fc158", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284076, "uuid": "f2555b50-c342-4bfc-a1ec-515bd24b7344", "value": "f68f4f7d654f7cb8a57e6715370d848f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0660128c-88f5-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644334649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334649, "uuid": "6e5a73df-4d85-4c2e-8f73-eb52e3a01478", "comment": "Malware payload (AgentTesla)", "value": "db1894b0ba5b919bdad2311a56d8e50c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334649, "uuid": "c02ef99e-4036-4a91-8cc8-030329c76ee4", "comment": "Malware payload (AgentTesla)", "value": "410fdedab7532f838e380b480c9f746113dd417af04be079c8c1de9831d95374", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334649, "uuid": "dd673783-d145-452b-8051-ad48c019b10a", "comment": "Malware payload (AgentTesla)", "value": "6f274437761b2bb065da27fb2489c4105be1db08", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334649, "uuid": "31bca0fe-d766-4792-b626-ac8f37434fb5", "comment": "Malware payload (AgentTesla)", "value": "e191d11e0570aa8ebede19934fd30c885d39b331ccffc1d3a4ce5f9d15d259f2baed88010011c43893586f1c81b880c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334649, "uuid": "ad264710-8136-4d2f-9454-3e02164981ed", "value": "T12A15AD3F75AD272FC175C775AAF09433B1409EA77200A994B4C69B6E0352A8E35C13EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334649, "uuid": "f321929a-97c3-4986-9ce8-a46e7c7eee9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334649, "uuid": "465e1e44-9b6f-4f0e-be1d-977d998d03b9", "value": "24576:MOGthoKOQa9/3Jybn6p7xrnlgKxQRncwAZ:MOuiKODY6p0Kxan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644334649, "uuid": "e56dd389-acd6-4025-b3c4-4a3583e1c018", "value": 902144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644334649, "uuid": "369fda25-da9e-426c-bbc5-7b758a26f2ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334649, "uuid": "64f81885-b422-4a38-99d9-8b4d67a6e8d3", "value": "Order Qty.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a0ec63-88bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644310227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310227, "uuid": "fe2ff08c-3e46-40ce-93bc-d6b87484f248", "comment": "Malware payload (Loki)", "value": "1f0734836ff14ca90f2e7e4361da0850", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310227, "uuid": "9602beb9-d12a-4c0d-a711-cf0e87ffd6b6", "comment": "Malware payload (Loki)", "value": "41785b5421a1f0add3f9966c281f69c83ee3f073cedd7563543276ec13c7f590", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310227, "uuid": "576d449c-e1a9-4790-aeca-8c939753ec8c", "comment": "Malware payload (Loki)", "value": "03c15ac926570f637325e63cb5565e8c6e47a14f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310227, "uuid": "db3fcb9a-6ab6-4963-bc44-a6a6587ccd20", "comment": "Malware payload (Loki)", "value": "e7a4c7a65dd73cc31ad8d91efefe95ea3fd788e4e2b68f2d821f0656787fb598be5ae2657c3c9a724f90259abff10e30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310227, "uuid": "b03da9a3-506a-44cf-972d-05d8d644e3f5", "value": "T14594583F49BF113AC6BCCB7198C0CE1FB466C5963977691D2A8625D909232F275C222F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310227, "uuid": "565f897d-274a-423c-92c1-03debf7150a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310227, "uuid": "53763a28-7002-46b5-afd1-5dcd744a9b53", "value": "6144:QLHaRPqJDAVn1bY2dHTM8iDD3b0/Uc5P+Ou0acRghwe8h:QLiQcp1bY2dzoDg/T5PRoygh/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644310227, "uuid": "5ee9133a-e0cb-4434-8628-48fb1c7e90da", "value": 442880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644310227, "uuid": "dad7138d-c2b9-4244-9ce6-a9f1264fb3e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310227, "uuid": "1ee3a599-8f5d-48c7-bfe9-7dd29e2f5b52", "value": "1f0734836ff14ca90f2e7e4361da0850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bded5f8b-88c0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644312194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312194, "uuid": "b2509932-63ed-4f7e-9729-2fa59cbe5ec3", "comment": "Malware payload (Heodo)", "value": "0890ec4243b0e2b1775bc9f5c168926a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312194, "uuid": "dbd532a9-fa47-4a3d-a8d7-aa560b0f8363", "comment": "Malware payload (Heodo)", "value": "4194584d9a7034d00021e470620a8252d78ff59b730cf8bcfe134bfb54bf2349", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312194, "uuid": "b82bb75d-b391-4bbd-9957-c464cd4e8cba", "comment": "Malware payload (Heodo)", "value": "924f4030917f412be61450dae17d6b2c977a530e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312194, "uuid": "8f93b5ad-f4a3-4238-884c-390964af17f0", "comment": "Malware payload (Heodo)", "value": "d7e952826fd1a04e91752c16f8d6d4cea95afcec1cf0b062c92baf2f88d38c0c7b6fd03a7a36ab3f9e2afc19184962de", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312194, "uuid": "af89ad43-3684-4cfc-b04f-2c513dd8d8b6", "value": "T155C36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312194, "uuid": "4b71f780-4efa-44e5-8b9e-5fc18093c6c1", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644312194, "uuid": "88833186-85b3-4ec7-886b-dd5d6937fe56", "value": 127518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644312194, "uuid": "f8f8b3c4-60ae-4760-bcdd-58169c8e4a50", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312194, "uuid": "89e98f1c-9f17-4298-ac69-52d55e89fe53", "value": "tmpkrbo7oa_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf2ad70f-8903-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644340999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340999, "uuid": "53076962-0099-42cd-85ae-eefee93f46bd", "comment": "Malware payload (Heodo)", "value": "29e174a72c13bdfcbf0586ceb6128985", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340999, "uuid": "3061a700-8af4-4822-a230-2a9d61294e62", "comment": "Malware payload (Heodo)", "value": "419d8f3954b148e03e63fe0f66be7149cae70fa6d1f8b4f01bffd09ebb0b78a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340999, "uuid": "92c22b67-52fd-4955-b2b7-0f8a673871b7", "comment": "Malware payload (Heodo)", "value": "687df707c27f8df32e8e62f5f3b31534eb39d9ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340999, "uuid": "18130358-0b85-4497-bb5c-daf547295ea4", "comment": "Malware payload (Heodo)", "value": "4d1a9b7e9eae98460bbc21ec67d1f523f2f89585135e58a12f2f1178ff5a0d3674a816e027a45ba7cafa35ff8fa17abb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340999, "uuid": "1f1baf30-edac-45f4-b8a1-6ed59dfd256d", "value": "T12E848D06E652C03CFEFB04B8D496CA66ED5E3A24169D619F63413A6D32613CF123F52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340999, "uuid": "6be11363-2055-4fe1-a8ba-6ffe99bb584b", "value": "79fb40281049052b3e354a6e444da473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340999, "uuid": "01afd133-48b5-44aa-83d7-9482dc446bba", "value": "6144:O56dLjBFLyztOofeYIjAmkB8lebi9JqGXdZ32mneM0laNUIbeURK46:YszuzNqjWB8f9JqQ2mnB0l4UMK46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644340999, "uuid": "3206e95b-160b-447b-a348-6c436bf08361", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644340999, "uuid": "02c3ca7f-f54c-4756-ba21-08bf89aa1150", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340999, "uuid": "02f0d609-4878-4684-9c03-f22ff746d6ad", "value": "29e174a72c13bdfcbf0586ceb6128985", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce65ff5-88f4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644334526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334526, "uuid": "d7e610e1-37c0-45db-b8d2-57402b808e9f", "comment": "Malware payload (Heodo)", "value": "e18d7414829038fa6590418aa588993f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334526, "uuid": "46707b19-865d-4a8e-87db-2d9e368560cd", "comment": "Malware payload (Heodo)", "value": "41a227b08579b8c6a0461ec05ad8f771a4dfb5aa8269bcd3c229cd925591a70a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334526, "uuid": "f4d51811-0704-42e2-b821-28e405734e55", "comment": "Malware payload (Heodo)", "value": "da9595f1bd70cffefd3d0bb3a641e18a2f13b67e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334526, "uuid": "6da5ba1b-a4f1-419a-bcfd-f040d5a28b80", "comment": "Malware payload (Heodo)", "value": "bf3cd94c59d4e1e3cbaa1be7a994f73ae3a7546e70686a9489ef04b44d8f3a1680db7dc20347391eb43f122689165afc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334526, "uuid": "def5cd36-0a25-415a-a37c-870271937430", "value": "T195F4C0006582907AE4F930B842667BF1E93D1CB0372511D39AD069FEA6E41F1B6B376B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334526, "uuid": "c0d1cd2c-4cdf-40cd-badd-eea0503c7a87", "value": "36d18f8cb3bee16af0421e6a936157a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334526, "uuid": "41e51954-6dcc-4728-bba4-f26ecc92abf8", "value": "12288:lBseOTwOg957PAMTEFv49thrFcmxLFwD7wGcXbtzbEOpUDlBkawsoei4:keOTwOUPnTC49LJxJwaCOpUD7noei4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644334526, "uuid": "d1fd41d6-e7c1-4b87-9773-79f95833b0d9", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644334526, "uuid": "729595b0-d5df-46a0-9c70-c65663b1a75a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334526, "uuid": "eeb0f450-a1bb-4bab-b88e-64c18f6c4413", "value": "L868.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f3c6813-88c4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644313646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644313646, "uuid": "0e01f30a-ef10-4ce3-825d-db90ff0160ca", "comment": "Malware payload (Heodo)", "value": "b146eb88a7476e8b1d5d2d13799649ec", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644313646, "uuid": "de91220d-fa17-4a95-89b3-8c4163eb5977", "comment": "Malware payload (Heodo)", "value": "41ab13b7cf1b1f04bb333884b11bedb9c777a2ecfdfefdd8d0574e6b3897c677", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644313646, "uuid": "ebf57448-1fa2-4dac-a3e1-0dbe038475f9", "comment": "Malware payload (Heodo)", "value": "8b04c75b706c806950bcd4270f7d0770d770f7c8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644313646, "uuid": "b72f391c-4e78-47d5-8d06-f467836e8cfd", "comment": "Malware payload (Heodo)", "value": "f23aaaf642270c5fc7f0db8f349fbe72979aa5c463a2ecd727132f717f4c3a81c8df4e2c753812ea16cd1a69feae9aeb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644313646, "uuid": "9e752806-83be-4c02-a32b-06fd464ce1dc", "value": "T1C8C36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644313646, "uuid": "61dea217-ecfc-40c6-a6f7-b9f377c4f3de", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644313646, "uuid": "891d0462-fef4-4580-a7eb-a82f07066f69", "value": 128518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644313646, "uuid": "0f4a0385-5858-4bd8-b4ad-79e4b307f6cb", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644313646, "uuid": "7aaba371-7e8d-4e61-84e0-f61cb1bfc9af", "value": "tmpx4tt8vjp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ced8f0-8885-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644286915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644286915, "uuid": "3fcd4c5b-e2a0-44c9-8633-23bab43c8b7e", "comment": "Malware payload (Heodo)", "value": "53a36b82bb47da3c6716c464e702ba7e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644286915, "uuid": "ab2c81a4-aed5-422b-a610-ea563611f14a", "comment": "Malware payload (Heodo)", "value": "41ac201e5ae4bd9f148312070969f9c9f9efe303372adffcc7693eae9daf03c2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644286915, "uuid": "463801ca-474e-4d0d-a8bd-35c348853722", "comment": "Malware payload (Heodo)", "value": "38979e98ddd12e88ecf9974cb9a2612ba0545464", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644286915, "uuid": "47d3440a-2b9e-48e4-bcea-fb7001e42c8c", "comment": "Malware payload (Heodo)", "value": "194980daf8c0bbc891db8e58200beaab3447f9df1f30d7cb9b036d19fdeda0b69cebee01d1f4729ed81055c7413c07e6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644286915, "uuid": "658c7453-cba4-404c-a36a-d99591c6b9f5", "value": "T1DC93F15D7E1C2A0BE19BF238CF3CDAA093551DD062A2B4B660A07EAC503D493C169E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644286915, "uuid": "5e7cf50b-966b-4a1a-b27e-3e869bedfe0c", "value": "1536:zZRoqIoLyy23qmwtv6D2RSKa3Xm1WBXz7yL64i+kkfa+3gtfvjHtoxzg5bjIFDU:zvoqZL4qm+vFa3Xm4nC5X5gxvhoxzMIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644286915, "uuid": "ec6e38f9-3d83-4d0e-848e-bcbe02666003", "value": 94232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644286915, "uuid": "9863deda-a4f1-48cd-93d4-f76d54196873", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644286915, "uuid": "269a75b9-f2e9-4198-ae7b-39044ff23d3e", "value": "tmpk507uev2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "542d0ce1-8919-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644350242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350242, "uuid": "52aeaade-a4dd-4a46-b766-57dd0da77404", "comment": "Malware payload (Heodo)", "value": "dd4c11cfc03c99fe60f52bde915794b7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350242, "uuid": "2ec7b2f0-d1cc-434b-acf6-68326eb896d2", "comment": "Malware payload (Heodo)", "value": "41c3cd07b2af48f063b1e5bc6e1374262bd26fd39f4a0de14c31030fdfbb4887", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350242, "uuid": "915c21e5-80f7-42f5-abf6-94f38a4dd358", "comment": "Malware payload (Heodo)", "value": "290e2a968c46cec681174545ddc0f15967b346bd", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350242, "uuid": "b9f4b4da-a8eb-4fec-84ad-cc30791ccf3a", "comment": "Malware payload (Heodo)", "value": "32b836b1830ce86d619b87b5605439b7e2aeb84401c6c4fbaec73c1d902e31b82c385bf6399f438260358bbf81c04680", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644350242, "uuid": "11094933-5d35-48c7-b255-c91c8bfc21ce", "value": "T18AC35A55F685EA1ADE0812350DDFCBF9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644350242, "uuid": "216a1966-dd7a-4aaf-972b-c430a037c980", "value": "3072:b+cKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBP:KcKoSsxzNDZLDZjlbR868O8KlVH37keb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644350242, "uuid": "50c316d3-b2ba-4722-89e0-896149ef6347", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644350242, "uuid": "f9441051-edd0-4349-87a1-264620be7950", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644350242, "uuid": "322196a0-fc0e-457a-8e0c-bb5fefb3e66d", "value": "tmplxpfgl6y", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf4231cb-88a6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644301029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301029, "uuid": "f0550070-519f-4cc3-9cd0-4cfee7d20623", "comment": "Malware payload (Heodo)", "value": "c6b4edbabad430e831c6e6e5f2492056", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301029, "uuid": "d629f324-be77-4f57-82dc-745335ccf84f", "comment": "Malware payload (Heodo)", "value": "41daa73d13922aef0d022dc24f65dd06ced111e5d131dd7b80fde187b1d85aab", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301029, "uuid": "1858e088-b2c7-41ea-82fc-6160eae77de6", "comment": "Malware payload (Heodo)", "value": "35d649c7a8090fa79e549a2c0f5579fbc22f9191", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301029, "uuid": "584d3387-50aa-4850-a92e-af46ef96cfef", "comment": "Malware payload (Heodo)", "value": "4e3992135ec58772e65511b5e22ec0f524f22045e1a0128e926710a50aef1b42cec5dcbbd345128f88e86e7bdc42f5f0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644301029, "uuid": "05ddaa11-f8f6-4e29-ba56-bc6cbf6a1916", "value": "T10BD38D6ABA48CA0BD94913314EE7CBF67336BC819F5297473295B72F1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644301029, "uuid": "af4160b0-8885-499f-a67c-6880515fc35e", "value": "3072:XcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3z:XcKoSsxzNDZLDZjlbR868O8KlVH3skea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644301029, "uuid": "e775a687-8a34-4035-befe-cbfed56ec04b", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644301029, "uuid": "66d56bc8-0a41-4dfb-8ad7-11e4192fff2a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644301029, "uuid": "5676330d-d842-4b99-9266-ecf08a57360f", "value": "tmpabafxrv4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e9bcde-88ce-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644317898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317898, "uuid": "9d035342-ecc3-46e3-9d90-84acafc4a353", "comment": "Malware payload (Heodo)", "value": "ee22fbf80a889f0fd20fd4181fddaf12", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317898, "uuid": "d362f904-f83b-4ce6-980f-90230b6fe5a5", "comment": "Malware payload (Heodo)", "value": "424621101bb0e312e8a8c0a1a04676e01eebc50dc02a8f07cf61e088e3dad60f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317898, "uuid": "38f661bc-8d3f-4694-82b1-0fac9b4bcfdd", "comment": "Malware payload (Heodo)", "value": "1872f97be0aa63f8d5ec3d4f1061e784e7af08f9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317898, "uuid": "9169df7b-1f0d-4a9a-a725-bec9bf6d6970", "comment": "Malware payload (Heodo)", "value": "2be3afbd7a965797871e43f506cdde16d3bacc1ded7932633567f7e9694c1e3aec94a345b62f9d4e56ae216e9d1b6f16", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317898, "uuid": "00f415f8-cbcd-40f1-9cf3-0d6620d78d35", "value": "T15FC36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317898, "uuid": "e5d5235b-a4ba-4426-a508-3d8962f146d8", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644317898, "uuid": "7262040f-84d1-44d3-9aec-77a0144e6e57", "value": 127688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644317898, "uuid": "318a5898-fbb9-446b-b8fe-2c9269a81e8f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317898, "uuid": "e03ae083-8c96-4b13-9e35-da3267ae3c50", "value": "tmp2xi6s7ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4b4ebf-88aa-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644302452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302452, "uuid": "92373960-88fd-445b-b632-c3f76c934d33", "comment": "Malware payload (Heodo)", "value": "5cd2f8915acf0e85487d94d6497693b3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302452, "uuid": "8f3dbb5d-453a-43ae-ac40-d016b4cf6ce4", "comment": "Malware payload (Heodo)", "value": "42bda326b802052e9864ed5758b27c8327fa6c49a75306dfde416f1302554d0e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302452, "uuid": "1f362c04-8f9e-4a19-987d-0f2f7512be58", "comment": "Malware payload (Heodo)", "value": "41bd9f9539ea9151058613c2abd855ddbbcff86b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302452, "uuid": "789464a3-85fe-4065-bd2b-1e537caa5b8e", "comment": "Malware payload (Heodo)", "value": "c4e2548a9620f64d5992f5a49536e77995b4e36df878bee60e29f580085c1825acd137c97438ecf55098966aa4241bcd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302452, "uuid": "d2be28a0-f659-4411-b870-702175e1dd9d", "value": "T171F4CF01B642C07BD4E920F882677AF2DA3D1DB0632511E75BD459E8A5E42F1B6B3B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302452, "uuid": "03bce04f-f02c-4c86-80f3-8908cd5886c7", "value": "36d18f8cb3bee16af0421e6a936157a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302452, "uuid": "1bb9bfba-1fb7-48e2-a491-9768b956c965", "value": "12288:0dxTcumr82wywP4LHIVBIAeQwfUgFm9V5BnE+skDSBLOgl16gtdXkX:8TrmrRwP4kVfw8gYtE+skD+LUgTXkX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644302452, "uuid": "ae7a76f6-6430-480a-a5fa-d07426e19d4f", "value": 781824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644302452, "uuid": "2d99edbd-f4f3-46f0-940b-17099164642a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302452, "uuid": "0f04ea6f-cc85-471d-b8fe-0fe6970c3f5a", "value": "emotet_exe_e4_42bda326b802052e9864ed5758b27c8327fa6c49a75306dfde416f1302554d0e_2022-02-08__064048.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "257a4640-88ed-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644331265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644331265, "uuid": "5eecba35-3362-4500-8d73-087e3b0ba556", "comment": "Malware payload (Heodo)", "value": "093fbbe408186c8919349f44fcfb2903", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644331265, "uuid": "119fc28f-3d35-4ef0-97c7-e5cbe4fc6594", "comment": "Malware payload (Heodo)", "value": "42c06369cea8cf46faee1fb454229eb78875bd4bffad472c00aa2693f4c12214", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644331265, "uuid": "fdd59903-40b2-4b0d-8c20-d6224a697247", "comment": "Malware payload (Heodo)", "value": "1d95a0433c2ea5c39eedcdafa1efcc7e1cdfa8e6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644331265, "uuid": "b430c358-46ec-4b05-a41d-4a0b70c09dba", "comment": "Malware payload (Heodo)", "value": "7d0c5d64f0d79b0f9b0f677290e41fe4cb545e35d73c4e1a89563ea0295feff424eab8df78c49fc5529384de8b5ee987", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644331265, "uuid": "1c81ab34-c8aa-463d-91c6-3bebd13abf77", "value": "T1F1C35A55F685EA1ADE0822350DDFC7F9333ABC828E9683473259B32F7D76590CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644331265, "uuid": "a08d6480-3cf3-478c-a253-0def4ee69a5e", "value": "3072:tpcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgcBT:/cKoSsxzNDZLDZjlbR868O8KlVH37keI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644331265, "uuid": "23135d24-b68f-411d-b7df-5bcfe55e712c", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644331265, "uuid": "e22ad957-f1a6-43ab-9670-f83215fc271e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644331265, "uuid": "4990c884-ba10-4885-be9b-b5de1538480c", "value": "tmpu6vzvtco", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ba21d8-88cd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644317676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317676, "uuid": "ed85cda3-ad7c-48e7-b4ab-695b32584913", "comment": "Malware payload (Heodo)", "value": "0f5ad11edba934275b683f6d91a59222", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317676, "uuid": "7806e166-a6a3-48da-9472-b22acd0e033f", "comment": "Malware payload (Heodo)", "value": "42f502f9370e485698788a6535b42611dce148d47e744bcee5560e352f3e7c9a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317676, "uuid": "b08eea14-41f1-4f70-979e-9fafb720000e", "comment": "Malware payload (Heodo)", "value": "a9eeef0470c0ac9dc270c9accd4f8f28e73298fc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317676, "uuid": "2786ae4e-9b77-4036-95e6-c629c1b36762", "comment": "Malware payload (Heodo)", "value": "f1155cbdfa6f12974ad71c5719042b2b49d65df39d88a623abd5f04dbe4d233d02a18dd2cb3be7e52aaade940d2a4794", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317676, "uuid": "7287c7c4-41c5-4612-9668-df3f1f2af6e6", "value": "T19AC36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317676, "uuid": "903512b5-d951-4309-98d1-f7acc48e2080", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644317676, "uuid": "79153188-5f15-4a7d-8b3e-40142043fca3", "value": 128017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644317676, "uuid": "e50ba455-eeb7-4f7b-a2b2-90d64e4a2880", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317676, "uuid": "20425dba-af95-4ab2-9cef-15875e789ab7", "value": "tmp6iunwopz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7879ded-88a9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644302412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302412, "uuid": "27cd55fd-92d4-4949-a8ed-296cc7c9e20a", "comment": "Malware payload", "value": "535b08cfd5bb887fda074d3ff3e5f34f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NimbleMamba", "colour": "#B0B1E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302412, "uuid": "95e08df3-b822-4467-9026-c9d132076be2", "comment": "Malware payload", "value": "430c12393a1714e3f5087e1338a3e3846ab62b18d816cc4916749a935f8dab44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NimbleMamba", "colour": "#B0B1E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302412, "uuid": "d9718f27-4d97-41ec-8ab9-065190b80547", "comment": "Malware payload", "value": "ad09a95386db11d2f90c4d5bb423a9af276619b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NimbleMamba", "colour": "#B0B1E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644302412, "uuid": "a271e5e5-c9d5-497f-9188-55a7a02d1ca3", "comment": "Malware payload", "value": "7112aa419ebf39dfe3db016b0c2ac0e6d5867cbf8d85627127b3ed7d9e6bbfda63d2249dd3cb282ee88212508db37bb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NimbleMamba", "colour": "#B0B1E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302412, "uuid": "0e90762e-39e8-472d-a5ff-509f0053b454", "value": "T16AD40C7322F6CA00C86E0E3114119DEF2BDA9CE5EBD68EEA93577AF4533094C6D1059E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302412, "uuid": "93dca7d9-bfa3-4bff-be6a-49d956b6a4a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302412, "uuid": "6417cb6d-67da-4459-8140-e8304f8cc6f8", "value": "6144:RCz7QVZLD1qASA0E4s6daEVcK6k1QV7mV9n496btp1pzGJ7V:rVZFqZhumMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644302412, "uuid": "ccff9ca4-fa56-43f0-a513-acb98a9e273a", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644302412, "uuid": "7e3a0b12-cbc8-4698-ad1a-a024f6f58141", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644302412, "uuid": "1c3cc07b-e887-44e9-a00b-52e22aff1837", "value": "430c12393a1714e3f5087e1338a3e3846ab62b18d816cc4916749a935f8dab44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "672d6349-88b8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644308612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308612, "uuid": "2f2e191d-5d7e-404a-9dd0-804bf6815e05", "comment": "Malware payload (Heodo)", "value": "16b5ce35965ac9e4968373d416712c36", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308612, "uuid": "56456391-2bf3-437a-96b1-652bbe9e4daa", "comment": "Malware payload (Heodo)", "value": "4311d3e217c7297680611a754b0d1dd102cf385a8d3c7e586e8fa9200772d4bb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308612, "uuid": "75bd47ad-565d-442d-98df-26f232e7b429", "comment": "Malware payload (Heodo)", "value": "b808ba8292e38b8f59b5d91301a7d2c155f68441", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308612, "uuid": "ca35396c-4fd0-4905-8e6f-13298dad9d3c", "comment": "Malware payload (Heodo)", "value": "15c86235ad21fa3de564bfc9c13275e4693cbca40dff5f694f47cc92cf1aef73adcd294addfdf068a18b73a2a3a1fe84", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308612, "uuid": "783f7f7f-0254-40ce-b653-750a49dd1e11", "value": "T1C793499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308612, "uuid": "76c3e187-b9ec-4cbb-b9f9-bcdabe733217", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644308612, "uuid": "4d70bd84-a632-404d-8a42-bbe50a0a3fac", "value": 96766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644308612, "uuid": "b6093483-bf10-4ac1-87cd-524a8264babc", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308612, "uuid": "42a40e3f-b97e-4173-a786-be3de54432c6", "value": "tmpvxt7uuqr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a5dde0-88a4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644299959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644299959, "uuid": "443c5f66-42ce-4c39-85d4-e67374549b5e", "comment": "Malware payload (Heodo)", "value": "a6d32d2e2de99924a18488364ef7287c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644299959, "uuid": "8a745771-3ae8-49e3-a852-78c8353cc828", "comment": "Malware payload (Heodo)", "value": "43626e0040fa6b57ff86275e6fa5ff29e9927d1cc61bc974b017f6306866433b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644299959, "uuid": "ff79abd9-21dd-40bc-91e2-eda6cf1d0a42", "comment": "Malware payload (Heodo)", "value": "71315015c86e44abe09e09f28b9fe0864814b942", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644299959, "uuid": "c7bf7bed-5ccf-46eb-b723-288aae4ed576", "comment": "Malware payload (Heodo)", "value": "b509d58afa7d99c9faaedaa9886c2499ed720fd8d86b2b9e78c5962f878498b2f8cab8457f020cdbe010e722cb0219a8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644299959, "uuid": "f77e29e8-bfff-4006-8b72-2bf59fa9313b", "value": "T126D38D6ABA48CA0BD94913314EE7CBF67336BC819F5297473295B72F1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644299959, "uuid": "99e3158e-70a3-4d69-aec8-38c6f308aaee", "value": "3072:KcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3W:KcKoSsxzNDZLDZjlbR868O8KlVH3skeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644299959, "uuid": "15311acf-e3d7-4580-84fe-0a04633276e7", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644299959, "uuid": "7cb5c9ce-fec2-4b01-b1c8-9f7fe14e63e2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644299959, "uuid": "074aeb49-646a-40ca-a595-e3ddacd09c92", "value": "tmps4_ihl41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cfea012-889c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644296462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296462, "uuid": "e78a20b0-821c-4542-b029-00fbde84733c", "comment": "Malware payload (Heodo)", "value": "222945fe1c0b83b06b3a87e35c060df7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296462, "uuid": "de82b8ff-739b-4aa7-a647-928a0646cae3", "comment": "Malware payload (Heodo)", "value": "436ca087c91d7e25dcea711ff036729d4b50faa083997fa1b6258d6161a3276b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296462, "uuid": "826b5ebd-fae0-4992-b959-a43045ba62c8", "comment": "Malware payload (Heodo)", "value": "bcdfcfa2592d24f71a29e6deeee4bc337e4c1ace", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296462, "uuid": "91120d72-e22b-4860-b811-55296300ca51", "comment": "Malware payload (Heodo)", "value": "63382be831925ecec9c093d11a015b121207c52787e80ae6e10d31ad17c3783154af6be70cce311f628b1e0a1b94d67f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644296462, "uuid": "a3a6d798-8f23-4618-a1fc-f87b43a2bf2b", "value": "T147D38D6ABA48CA0BD94913314EE7CBF67335BC819F5297473295B72F1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644296462, "uuid": "06ae7ad8-0e2e-4de3-96bf-a6941114ede2", "value": "3072:3cKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa36:3cKoSsxzNDZLDZjlbR868O8KlVH3skeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644296462, "uuid": "6ce20aaf-88bc-40fc-9931-071ea1faf2bc", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644296462, "uuid": "85a2c9ce-cd94-4830-9565-86c7a13edcac", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644296462, "uuid": "8f09fd41-0835-482a-8d80-ba16f7ff4a9b", "value": "tmp5unkayc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0553f2d-88b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644308386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308386, "uuid": "406ad89d-d7f2-4ac4-aa09-7e03b863b0f5", "comment": "Malware payload", "value": "a7ad62826ce5f5cf4437ac871dcc2a15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308386, "uuid": "81a4ee69-cd60-43d7-bb5d-b8a08924a341", "comment": "Malware payload", "value": "437d2c1c4809705923660bfa52a5b9036dc09b308c0c72cc63c293dcc40db0c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308386, "uuid": "5e6f5f23-c73d-43a0-a12f-d2c1a0e6d2db", "comment": "Malware payload", "value": "23c96bc2696c74473390b05d93b1098e2c3ab523", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308386, "uuid": "4378a828-dab0-41d0-b0af-c16e14246088", "comment": "Malware payload", "value": "8e552ae87ea679a504ade3e6efe4a9920342efdf3600fbcd8485d65b2f8538dc22edb9ba90a9574260f6677e64286143", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308386, "uuid": "7b372a8d-dca0-4011-9aa8-0864f3ce4cf1", "value": "T1D63523DA4847E635E8B0BD7C8B2DBFE45719507305613908AE27C2EC11B4DE6BB81F26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308386, "uuid": "8a265275-1ade-4c40-9c55-6666cf53a321", "value": "24576:RcwE8J93txM+xhYVuoEYpe2LSaQ++WsVs52vggT4RMHnMoLLbmcvsD/Rhx:ewE8J99lxhYV7npeOSaQ++9VHvggT4RD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644308386, "uuid": "848f672a-810c-44f8-8238-48f0adcb0753", "value": 1108436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644308386, "uuid": "8a71536b-7aeb-47c9-ab1a-8d180e3756cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308386, "uuid": "dd1ba6c2-0fef-40b9-99fa-d15a75198744", "value": "a7ad62826ce5f5cf4437ac871dcc2a15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e1ebfb6-88b7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644308114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308114, "uuid": "3b48ff43-4eab-4de7-a539-b576e98de6c5", "comment": "Malware payload (Heodo)", "value": "aafdec955211c43a4bc660f66bc74d5e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308114, "uuid": "bc018eb9-f663-4c19-b1a4-5def46ac1e98", "comment": "Malware payload (Heodo)", "value": "43920d515f90716aaebc49e74df085fb0150e44886368c440c73a6f6b6d623a2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308114, "uuid": "e1e00502-5148-4386-b169-27dae29a71fe", "comment": "Malware payload (Heodo)", "value": "91b731bedf8b93afb9bd9024ff09ba208775dc96", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308114, "uuid": "6862b51f-d95a-4872-b5d0-3b037c69680a", "comment": "Malware payload (Heodo)", "value": "7d6c327a925e22bd67d8891b67d32a9a4aa8936541bdff50d475a727b44166762925ed2d9f24e4e830b13023365d451a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308114, "uuid": "4471b8a2-c387-4f26-be62-1febc9f9f9e3", "value": "T17493499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308114, "uuid": "faad7fd6-724a-4607-a9c0-0e9921518f90", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644308114, "uuid": "10b16027-1512-42b6-853e-0e7385a4e050", "value": 96805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644308114, "uuid": "190fa014-2090-461a-b535-788522bf48a6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308114, "uuid": "a35d0947-ff1f-41de-a463-d12de890ad6b", "value": "tmp29gzy60x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f759d8-8886-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644287327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644287327, "uuid": "5b560499-c993-4daf-91d4-7d9bf2cddcd1", "comment": "Malware payload (RedLineStealer)", "value": "a336f971fbd4fce8b8747f3f31195493", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644287327, "uuid": "9f41068c-a7e6-47da-8677-89f910dbc7b6", "comment": "Malware payload (RedLineStealer)", "value": "43ac8f3df357a72079b4370be441b785aad0458d63f61b1b0e6f6a8b5213d4e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644287327, "uuid": "40621f5a-2dac-49e0-b438-dc1fcec2384a", "comment": "Malware payload (RedLineStealer)", "value": "88d55b5822a5032f0a7bb83c7da8db936bd76a30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644287327, "uuid": "cc7d70ec-b430-4546-8962-36485ac509ad", "comment": "Malware payload (RedLineStealer)", "value": "8ef7652440236fdee4357f16fc004fd45240a8aa39d80c3ec163eee0a5c36aa190948eb3a69347b146f4e390720daeb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644287327, "uuid": "2084cbb0-2398-4130-a35b-7b6f471f8eab", "value": "T11306337BA53C18A8C87336B4E51548B49B5AB7B4D4CEB56277CCB4DB620C1CBB4B2078", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644287327, "uuid": "3bdc5c71-6a49-454c-9268-441beaec53f8", "value": "18df1dcc1fa258b4d6e464d165239b75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644287327, "uuid": "ec8867d8-4d0b-4105-a206-22183f7fa6fb", "value": "98304:NqJAxjLe95nGlcQeR3OarAl0V5QIFZ76OGUv:NMoe95nLVOarFVGIFZPGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644287327, "uuid": "1120eedb-67c5-4479-9e1b-5f979710e617", "value": 3761392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644287327, "uuid": "d0f16eac-73d4-4d0d-a4f5-ce29375408b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644287327, "uuid": "3c7bdb09-9cbb-48dc-a5be-9ade854a0a66", "value": "a336f971fbd4fce8b8747f3f31195493", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c2e4aa-88dd-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644324532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644324532, "uuid": "6ad6cc58-4e3d-4d50-9e2c-c2c07cf2e98b", "comment": "Malware payload (Formbook)", "value": "2f4d1fb0bc45c3163f44b3c68b72f702", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644324532, "uuid": "e788b388-fa44-4f70-b373-cf1191fac1b0", "comment": "Malware payload (Formbook)", "value": "43e5448bcdf71ade3676bfaee6524e9cee7f3337e58fd4cee314a148f0597dc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644324532, "uuid": "19a20707-9d59-44f9-b628-3db9406fea9f", "comment": "Malware payload (Formbook)", "value": "c16f103099227125f53d22b7958c08cd9df9af55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644324532, "uuid": "a2a33f6b-6222-4700-80f0-8caf7ddac1b4", "comment": "Malware payload (Formbook)", "value": "e9a3240f511fae759a23cf3ba336dc8057e4a8d4ac6b44242ad20affd989b094928047c8f33be17b87666377ae25aebf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644324532, "uuid": "67b40229-eb11-4aba-b7cf-3d0f223bc940", "value": "T17DB46A3F49BE123AC6BCCB7089C0CE1FB426D5563977691D2A9226D905232F375D222F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644324532, "uuid": "29e6f2f4-4dca-4bea-aff9-41b1438073c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644324532, "uuid": "971aabdc-8fb7-4a2d-95d7-2c74a6bf4d6a", "value": "6144:SIJYIsISGPYJDa6+psBZQ/k2qz3ezTKeIzayhToQVeqMKVqgaNtGnk+bfhePT9PN:SIbaulsBZQpa3e3SFgJKVq/39P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644324532, "uuid": "e34bf959-249a-4ae1-af4f-8f5dec29434c", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644324532, "uuid": "5161b3bd-1618-4266-b410-fa81f2024f77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644324532, "uuid": "2b889ff2-dd07-4aa4-a3ba-48bace238037", "value": "IMG_202449003739304000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e451dca-88a0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644298316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298316, "uuid": "fc1758a2-3ff2-4cb6-b77c-d4d57a4c98a2", "comment": "Malware payload (Heodo)", "value": "26f0289f8313b83d31ddf1c14d5f9479", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298316, "uuid": "1c8282d7-cf1d-426a-9685-c391ad5c9668", "comment": "Malware payload (Heodo)", "value": "43e898bf53e3a64612babf806bb8b2a12b3e5943d63b661b31078d83aee24bca", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298316, "uuid": "af998425-715f-4a7d-990c-a0253d5a621e", "comment": "Malware payload (Heodo)", "value": "bc0c35f8a0dccd7555fa83b53c6a4e35dc563bc3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644298316, "uuid": "ed427f88-afcb-4dff-8e90-8c9a1c076ffe", "comment": "Malware payload (Heodo)", "value": "fe3c60c9c1778df614fa64e958e8071564dffce929b07ec99750f222ee1912c7c07204ce19e3ef7e1dd81599b0892fea", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644298316, "uuid": "125e3428-c6a3-4380-abd4-91f81dfa6e16", "value": "T10ED38D6EBA48CA0BD94913314EE7CBF67336BC819F5297473295B72E1C3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644298316, "uuid": "e4c8782a-2a75-4fd3-8d07-a86d381ac0eb", "value": "3072:mcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgDa3f:mcKoSsxzNDZLDZjlbR868O8KlVH3skem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644298316, "uuid": "c4263a4c-0ec1-4b3a-b805-5f12c36ac269", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644298316, "uuid": "506860aa-78e1-4d91-a9c7-1c347b5367cd", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644298316, "uuid": "ec004b0b-9edb-4023-943c-302e6ecfeccb", "value": "tmpz0nao03s", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe5b3f3-88b6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644307976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307976, "uuid": "7996f112-7e0c-4bec-aee0-9edc1758c224", "comment": "Malware payload (Heodo)", "value": "eb87c73533b5ea135d6e591d405b1434", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307976, "uuid": "940e077c-90c1-4d67-a253-ba4fba7f0271", "comment": "Malware payload (Heodo)", "value": "43ea4eeb90312fd5e92a08b1e11d1bcbd693da52c23cc13f9b0379e0cb7ccf63", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307976, "uuid": "dcebb382-e474-45d7-b094-5f2174177d47", "comment": "Malware payload (Heodo)", "value": "eec3632d03e53c884a0f8dd52259d81fa48fc732", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307976, "uuid": "8b6a448f-2586-4ef8-aa23-5f84ef7c73f3", "comment": "Malware payload (Heodo)", "value": "57f4d0bba8c773f8c26ad99a282378df58b996b556e6af4ac8afcbddbcc09462fae593494d4809346b9ab48ea751df20", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307976, "uuid": "2a32556f-e556-4193-9ba8-703e62e74147", "value": "T13DF4C0006582907AE4F930B842667BF1E93D1CB0372511D39BD069FEA6E41F1B6B376B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307976, "uuid": "84af72c6-dbc8-43fb-ab4a-98ebe252cb05", "value": "36d18f8cb3bee16af0421e6a936157a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307976, "uuid": "750bf7dd-b901-45ee-9b00-3dbad2e989db", "value": "12288:lBseOTwOg957PAMTEFv49thrFcmxLFwD7wGcXbtzbEOpUDlBhawsoei4:keOTwOUPnTC49LJxJwaCOpUD7Yoei4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644307976, "uuid": "34c8a151-2e19-4e03-ae66-52ddd6daa6f3", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644307976, "uuid": "6ab3634d-682d-460e-9cb5-efa643157d53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307976, "uuid": "898fe29f-c102-4733-9c29-dc774f212e3c", "value": "emotet_exe_e5_43ea4eeb90312fd5e92a08b1e11d1bcbd693da52c23cc13f9b0379e0cb7ccf63_2022-02-08__081250.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b8ea75-8890-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644291432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644291432, "uuid": "5d434a62-2340-4126-9309-dc01d6cf3dc2", "comment": "Malware payload (Heodo)", "value": "49a8a6ae99daa0abafe7d8ed08ad1986", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644291432, "uuid": "c4ab83a5-ddc8-4b78-af66-2d5730b55338", "comment": "Malware payload (Heodo)", "value": "43efedbffc6fb4c71220e7806d25b52286756e1365ae1db27ce7e22bdec677b7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644291432, "uuid": "a4119b8f-c0a9-47e0-bcd9-3641aee6faed", "comment": "Malware payload (Heodo)", "value": "e55e7d9fc80529c22f785003ae039d228d8608e4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644291432, "uuid": "275f9287-bc65-4317-b734-e487c3e93f3d", "comment": "Malware payload (Heodo)", "value": "4e18c624f030091f6c466dcb8ce6c8d4b9152cea20237e360a406d7847dcabc4a8641e342f85935cdf4821c4d44ce013", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644291432, "uuid": "ef9766cf-005a-44a5-a66f-6e2f6afce7fc", "value": "T1DED38D6ABA48CA0BDA4913314EE7CBF67335BC819F5297473295B72F1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644291432, "uuid": "05fa01c0-5a79-4334-a0b7-eea3ee84d2ea", "value": "3072:ccKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3u:ccKoSsxzNDZLDZjlbR868O8KlVH3ske3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644291432, "uuid": "3ab38e70-5d29-409d-88a6-aff0f5f1ea8a", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644291432, "uuid": "f4dbc57b-b0a5-47a2-8fd1-2d6bcdb8932c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644291432, "uuid": "999ea492-9dc7-48c0-a170-d33fb078bbdd", "value": "tmpr1l5janv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1cdf801-88b7-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1644308308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308308, "uuid": "b7359e54-1aa6-4044-bd29-cdb82f14b1fd", "comment": "Malware payload (Socelars)", "value": "d46685ca959039f6f77ecb07c8d28f09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308308, "uuid": "67d578aa-f19f-46a2-97e9-979b9fcb3e5a", "comment": "Malware payload (Socelars)", "value": "43f9a07f0de7d266f7ba0b40cc3ab22909085ef902db4408fbd02ee4533f00cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308308, "uuid": "8b0421d6-c4d0-4df7-9f6f-307774f9fe32", "comment": "Malware payload (Socelars)", "value": "eb680f951fc30e57a5c4497489843ab387c39b84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308308, "uuid": "9db2c7b7-1525-4515-a94f-38ca2e5ce4ff", "comment": "Malware payload (Socelars)", "value": "3af51e727ce6cf4a40f6561133cde1f1e5590a4e0d7e15f245e22ea492885fa46580ca9255dfe6544aab92c343b04a78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308308, "uuid": "a0a01097-b875-403d-a7d2-f1a6b91b772e", "value": "T168657E11E642D036E8E30072C6FFDAFE8D286E21830454D7D3C47D6B7A719E27A36A56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308308, "uuid": "5893279d-b4ff-4343-a06e-784759ea16aa", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308308, "uuid": "a406c539-0ece-4684-8515-b45e2d872bd5", "value": "24576:NbZp5sMbsPTdhUmIKuXH7aHespoWThCdEieWnwhOkmOmhyOS:npB4dEnbmhHWnwhOkXdOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644308308, "uuid": "48c62c5f-13db-4871-880d-e96d658b7200", "value": 1490432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644308308, "uuid": "6364b374-b630-4330-98e5-a7f18779cffb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308308, "uuid": "0e38704a-b5a4-4c95-a0de-88ac1635f55b", "value": "d46685ca959039f6f77ecb07c8d28f09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d230c853-8885-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644286888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644286888, "uuid": "0055af54-c70e-4438-9673-68b694c1fc2d", "comment": "Malware payload", "value": "820697c11ed57c5ae888772d2e80cfa2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644286888, "uuid": "5a828a11-c46e-4db2-9688-e22beddea974", "comment": "Malware payload", "value": "4408fd1b4464aa5fc5a59034f51297dbab5c465d050f42325369b531dd756753", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644286888, "uuid": "cca1b2b2-84da-4438-a8f1-ee87dc76ded3", "comment": "Malware payload", "value": "9468da8cacb9934b9885b5dc4d86abf4d897340a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644286888, "uuid": "e9a4334d-510d-4a8f-af5d-208a2c1550f9", "comment": "Malware payload", "value": "973eeeb7719159143337844b72e1a52dc32b752aa89089b44fec96bb6d84d8142d5b4552edfaff7983e7117b543d20aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644286888, "uuid": "5e6ed64a-73f9-4f2a-9a7f-3fbfb8294c04", "value": "T1ECE3E72AFA948F11C5440571C5EB952003E7EBC76373EB463E8A179A0E027ED5D8EBC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644286888, "uuid": "fc4bc748-1970-42bf-b98a-308ef091f93a", "value": "3072:x1THpSCPZpXVGNMz3lnHRN6Ts6Ozh0TB9H47CnMUOTjUpybLfXr1wtKyp9FjVmSV:9VLoB9H4aMn3MGDqtKyp9F++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644286888, "uuid": "53d3a8f7-2718-4e59-8788-28aba72a27a5", "value": 145920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644286888, "uuid": "99113657-4c4c-496c-8187-932444516c99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644286888, "uuid": "d6b266c0-7c90-4e43-8a13-16668c40cd45", "value": "820697c11ed57c5ae888772d2e80cfa2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9adeae24-88e4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644327597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644327597, "uuid": "63ad8d99-ddb9-452a-a57d-37e218da1e2e", "comment": "Malware payload", "value": "caf33f87dac6fcd8ecb3c312ca30b740", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644327597, "uuid": "f05e37a4-3127-4779-a989-098535939291", "comment": "Malware payload", "value": "4409ae5538722160df6591dafa8eaf7cbf537ff8a00ef2931cf52d855c154bd1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644327597, "uuid": "71f7ac40-1780-493f-b0ca-8700604ff10d", "comment": "Malware payload", "value": "5d2902a19e70520d5292e2163c02aefb7a62c63f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644327597, "uuid": "09df721c-9ebe-4a61-8e39-89e5f30a8b98", "comment": "Malware payload", "value": "88861bcf40705ff48aa6586787a8759a884bd9dc2ff571451ba6f7e571b09ec8733f01313588abb57e9928a27ff1e5f0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644327597, "uuid": "48bd983d-01aa-4d0f-8c51-5217596f6be9", "value": "T18B5310094DE3595173B3B0BA97DE945A7AA7C0C74F8B9E203C8D439AEFA103485F85D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644327597, "uuid": "e39679cb-9172-4c41-a643-54d0085fb45c", "value": "768:oFsJEryYUeNMZeZr2H3iFF9J50A8XZqP99pJW3gObz/P:xEr1UeNsc2HEBGBZqNigQ/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644327597, "uuid": "ead35940-d90f-4a32-bedc-e1615b4421c0", "value": 63172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644327597, "uuid": "24d0db30-6e89-46c2-9ad1-c691bd67a784", "value": "text/x-perl", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644327597, "uuid": "6ddb3126-b929-472c-8c4e-38cb581fcb35", "value": ".dr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d84eba96-887d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644283462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283462, "uuid": "02ce2325-707a-4f72-8cd7-db111488f4cc", "comment": "Malware payload", "value": "e9520bf851e6cce8f3c8a8023e8dbeed", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283462, "uuid": "06401839-bb80-4e94-8f93-087b4d0ff79b", "comment": "Malware payload", "value": "4419623f686ade6bc064995a330641c83c9fc391b6504234aae9ae13731eb41f", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283462, "uuid": "75bb0bd7-dc0d-49dd-b009-75014db22570", "comment": "Malware payload", "value": "8ad6731a1def15575bc13364e0fff6a14cbf788f", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644283462, "uuid": "2f419a7d-021e-487c-8527-0aaf9f9bd90e", "comment": "Malware payload", "value": "a029de95db0683250a3c8b50a96b6a88055eb4c9d5cf0e13c44b26f4ce7d446935a2b13443245c9b17acac6e95c47f51", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644283462, "uuid": "912283c2-ba7c-46fe-997e-8cce93d86eef", "value": "T18144014AA751C6E9C4210AB1ED4F8BA09B750D515C5286E7F9B0BFBF3F33018A642266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644283462, "uuid": "0007b85a-6f7c-4369-b432-d09aac6e8369", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644283462, "uuid": "672c6374-0097-437f-b128-3c927fda76e5", "value": "3072:4lH4JCts4lCxwh81znndePWAWyPXG4dWJva0fMGR0zN6ahkcPlAEw0p7Tu8PykIF:4aMts9wh0nde+WQJv1k11w0p7T1ak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644283462, "uuid": "3cacedb8-ed58-49a7-ab83-8d3ebc58d8a8", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644283462, "uuid": "794fcfc9-16de-4c79-b126-b304647aed5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644283462, "uuid": "522a1c80-97ac-4f10-a17c-66b76f992a95", "value": "INV_22498RDHL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad18b44-88b8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644308484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308484, "uuid": "c9f3d817-09e8-4cda-905d-3806bb4cf761", "comment": "Malware payload (AgentTesla)", "value": "ef02bf6da69e3260a17076527c7d8ea0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308484, "uuid": "e6d0f9fd-edf7-4346-a20e-46833d0514e9", "comment": "Malware payload (AgentTesla)", "value": "44849e8ac943e1338ac15bcaff1510f35c1fd51a7ed360489ea56f8f2e0241b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308484, "uuid": "a449ed52-be5a-404a-9b03-63ba2faf05aa", "comment": "Malware payload (AgentTesla)", "value": "40124dace7939165a00399baf6c18791397aa963", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644308484, "uuid": "0c7f0ce7-6b14-4027-ac60-684ad5ce7a74", "comment": "Malware payload (AgentTesla)", "value": "59e0b6aaf74651a2aea9d8d012ba92151a47983342ac9aa4cf5ff452270ddf4dfe292579111563ed71f26d260413e77f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308484, "uuid": "b3feb8bb-5b91-406d-b019-b970418f6e0b", "value": "T188D47CF926718178D53FED3EDBE658A8CF41286F4BE87B2000E9593D0839097D61D89E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308484, "uuid": "cf645fea-50cb-4435-8809-dafec078f85d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308484, "uuid": "6439b1a3-78a3-481f-98cf-28696d8ba7ea", "value": "6144:Ji+fjAdHfwdbWKG6J92yrH7/ZdCdf0OX0+awYwMlTDcFmrICJxINOWp5QuNkAuN7:U+fjApeI66ULZ2NAomrJxmQzNrkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644308484, "uuid": "5c909ba6-a9e5-4f97-a610-8285f557473f", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644308484, "uuid": "a99ffb35-6878-4476-a69b-8ec98a694ca1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644308484, "uuid": "64935d4f-1f81-4b10-a08e-c7ba981f3231", "value": "COMMERCIAL INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c3e16e-88a6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644300956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644300956, "uuid": "5a72b0fb-5873-490d-bae0-46169bf9e4e4", "comment": "Malware payload (AgentTesla)", "value": "11777e74ee66a2c56a66902e9c9ca1b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644300956, "uuid": "0226cbce-6c2a-4dd1-ae21-b07c092c6e54", "comment": "Malware payload (AgentTesla)", "value": "44bf425ff51c62207c594ba1ab4304475f312d434b9137f576d112c14642b741", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644300956, "uuid": "259b9aee-1857-4df8-9090-3a1626a97058", "comment": "Malware payload (AgentTesla)", "value": "afbfe9de46aa8123e9647f6477c908b6bfbe58c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644300956, "uuid": "5a31cefa-db1b-4470-a5f7-13996a058941", "comment": "Malware payload (AgentTesla)", "value": "d5aba259413b48b631f860a8763dbb9b47880494ce6102fae7f26e6933ea078c6e1c4d0087f81811e2c10358896ddbf7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644300956, "uuid": "1b24597a-12fd-4962-a80f-33ddf3db59b2", "value": "T1BD0501987A14B68FC82BCD32DD89AC71D75038B69707E7136483239C994D7EB8F052E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644300956, "uuid": "ec95d4e7-0224-4ff4-b12f-09bdd13db33e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644300956, "uuid": "10291059-04f4-43cf-8f2d-331f7dbd50a6", "value": "12288:JHMCOzbHYgss9kkt6F5dkF+u4SatqXfPFarsouK8I/+FmDi/rg2eBMSJzVRmr5YC:l2kszqdNtqIrspQ+FmGU2eBM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644300956, "uuid": "7f3a3580-8690-4e5a-97c3-05a11afec267", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644300956, "uuid": "c7be1fec-823c-4e1a-b75c-e172e61a00ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644300956, "uuid": "44701c3d-6f5d-4ee4-8461-eb1a1f944c89", "value": "NEW ORDER (Order#-01172320202.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39032277-88bf-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644311541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311541, "uuid": "8252c4c6-7fd0-45d4-af76-d99f16073ddb", "comment": "Malware payload (AgentTesla)", "value": "438c8df1fea857b1c9e54a887e95d0af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311541, "uuid": "2804b21d-13e1-4be7-9783-437ee2a8ddea", "comment": "Malware payload (AgentTesla)", "value": "44fb0ba5c41e523c4597e1380039e8a5dba3687957bb70382ec8c54e7f0fd7a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311541, "uuid": "56d215c9-b80c-45fe-a8d4-261a456af6de", "comment": "Malware payload (AgentTesla)", "value": "a016756040d9dac424ba8d4438c4a9854369b2d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311541, "uuid": "a18172ee-06cc-4964-96c5-84d287b9e595", "comment": "Malware payload (AgentTesla)", "value": "ac491c4e76904acec6ccef767df7fc059ac485bbb0a5edb0e5c188eb2ef35c3d1ab87ee15dcf254592f484bb4b750102", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311541, "uuid": "af65fd2e-1c59-40ba-a90d-cc2ef9bec752", "value": "T125C49C3F49BF113AC6BDCB7198D0CE1FB422C9463977691D2A9226D905232F275D222F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311541, "uuid": "a9492669-6606-4ae4-abe4-4744b8a48cff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311541, "uuid": "6dc8fbfb-0e05-4243-9cfc-b88f1ebe3260", "value": "12288:8SYBs3I8jDpmMvfYHDQ2xJEnRccbrvrGcC9Ge:8hapJYM2xJ4/6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644311541, "uuid": "660dafc3-e11d-4e60-8b13-63065c2a295c", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644311541, "uuid": "083aafc5-5d9d-4e11-ae51-fed195778291", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311541, "uuid": "dc932995-cbac-4f65-a483-0204d692f48f", "value": "438c8df1fea857b1c9e54a887e95d0af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f0aa34a-88c0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644311900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311900, "uuid": "e73dfba7-26ef-48a4-8aed-b83c167af435", "comment": "Malware payload (Heodo)", "value": "cc9ea1e08fd32d6bd2353f564558a809", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311900, "uuid": "d4d7b9ef-497e-4881-a94e-9df7d9740ca3", "comment": "Malware payload (Heodo)", "value": "4513f6694a950a1b2a9325ab8a2aa95f21146dad96f3479f4679b1364ef66bbc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311900, "uuid": "2cb8a1aa-fb65-4bf3-8cdf-11d3c06e65a6", "comment": "Malware payload (Heodo)", "value": "69169e994f57c0eea5b2f32e13ec73dc910afdab", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311900, "uuid": "4a130411-c278-4d3c-93c5-69812363992a", "comment": "Malware payload (Heodo)", "value": "c8d6e5f728e0d8006b2bbd4760f37ed0ab05df6e24153923676308d9404dc80bebcc453df7b4dc2f0e811363351f23c5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311900, "uuid": "6988744e-2e6c-4c16-80ef-b40bebd79be1", "value": "T130C36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311900, "uuid": "59d2a1d1-31ab-4837-b70e-4cddd8d25681", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644311900, "uuid": "e58f72df-401d-4dda-a0c7-db8a51d19445", "value": 127814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644311900, "uuid": "862b8f57-9b8e-4819-bce7-8f2cbce3c37f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311900, "uuid": "f5395f9c-e5c0-4064-9dd7-df83e7f7b6a8", "value": "tmp9kdngd2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb6310d-8918-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644350019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350019, "uuid": "fa2c8c47-7648-4279-8075-5595262a1615", "comment": "Malware payload (Heodo)", "value": "e496e1ec6a05cd322f1f8adcdf246a30", "object_relation": "md5", "Tag": [ { "name": "5", "colour": "#9EC247", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350019, "uuid": "bebf5f0d-769e-4e42-ade3-8ecd321fdd44", "comment": "Malware payload (Heodo)", "value": "452c447868948335de3e8ed8cd5dfd6b87ccf49212767816b956d43cefda1494", "object_relation": "sha256", "Tag": [ { "name": "5", "colour": "#9EC247", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350019, "uuid": "b0152935-436a-4415-8827-9d3f91220e44", "comment": "Malware payload (Heodo)", "value": "aa2db1a865be92a3473d324c7e97a7dd9663b006", "object_relation": "sha1", "Tag": [ { "name": "5", "colour": "#9EC247", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644350019, "uuid": "baa3667b-5043-43a1-ad79-c3f481992609", "comment": "Malware payload (Heodo)", "value": "8a1f187b51a7322d13d6c6b82b91f408cdaa095ea45fdb1ed9e4cfa0c1b670884949e49eb3145567a8f54a9fe7e2bcba", "object_relation": "sha3-384", "Tag": [ { "name": "5", "colour": "#9EC247", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644350019, "uuid": "2c2fee9a-4d04-473c-8c13-1f63fa6855a8", "value": "T1AFC35A55F685EA1ADE0822350DDFCBF97336BC828E9683473299B32F3D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644350019, "uuid": "39a50ed6-bd58-441c-9880-bc15dae92f5c", "value": "3072:oUcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgiBG:TcKoSsxzNDZLDZjlbR868O8KlVH37keT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644350019, "uuid": "096ac7bb-73a9-492e-9845-c13cf406b091", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644350019, "uuid": "cf01d759-e3bc-4a12-977f-a0e1b40dbb25", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644350019, "uuid": "9d30d3b4-ff37-438c-8e3e-f3aa8b38fae2", "value": "tmp9g1ilkqc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc2ed45-88b5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644307523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307523, "uuid": "8735aaf9-da0e-404e-b88d-e3ec353efc57", "comment": "Malware payload (Formbook)", "value": "4f0d2852d2aad43eddf9416661933701", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307523, "uuid": "9280d16d-c8e8-4903-99f3-ecefe1547bd9", "comment": "Malware payload (Formbook)", "value": "45469e46b7281b1f1c74cbd1953e47121a233462b7ab0db7b8346c5b7b3dfa1c", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307523, "uuid": "462b54ab-315d-405a-addf-83b3d0bf3a54", "comment": "Malware payload (Formbook)", "value": "abe4f65cc594a4c217a65486c3025832fe037161", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307523, "uuid": "fc5dd0b8-b6d7-4728-934f-85c02da06abf", "comment": "Malware payload (Formbook)", "value": "1dc0cba2266cdeeceb7e9eb2b51a9d3a04612abacbe6622f8d79f1aa8f65475124a7b3694c370f7f1afedada22fa3466", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307523, "uuid": "fb24b66e-b93f-41f3-8eda-d28372921078", "value": "T197C4F147FA4E5B12C96991B668CFD4F6436667F6B333DBA82CC4238D0E613E10E50786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307523, "uuid": "c2f9a37a-a5d8-4d38-9ff8-e8a733164f79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307523, "uuid": "361c8ae0-7eac-4a98-b583-ae4bd83efc5a", "value": "12288:gFJGB4ay527F6OgOvJxgkMWK0EwL8DR4xlIdXl2u:gLmF5/ovx0EwLGyxiJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644307523, "uuid": "b15d491d-5fdf-450d-90ba-8505dfe06949", "value": 550912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644307523, "uuid": "2543615e-9ad4-4e58-acef-7230e70ef273", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307523, "uuid": "0ba64654-5121-4b73-a989-27b874af1138", "value": "DHL Shipment doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d15f631-88f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644333963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644333963, "uuid": "c00e1060-7c18-47a9-b674-1e20ab7311d9", "comment": "Malware payload (Heodo)", "value": "3dd56c5e9310a30a23dd3996a7265a8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644333963, "uuid": "0ead25b9-54d8-4de0-ac37-021816ea9fd2", "comment": "Malware payload (Heodo)", "value": "4559b85777eaf5c967c492cec6e4a7bf5886b7af2291154a07103f417509d3cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644333963, "uuid": "ae87f546-fe75-446f-98e2-517efde24271", "comment": "Malware payload (Heodo)", "value": "bce5f3b854e919d7303f3af0e1bb1c3f30d4f392", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644333963, "uuid": "11af3001-c86c-4022-9995-2fe28c40d885", "comment": "Malware payload (Heodo)", "value": "9adebab2e2b66af5338adda8bee46b6988b93bb50c871885eaad5f74f7b901af91c74ee6464a2cd47a36ac315e6c650b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644333963, "uuid": "88af1d10-8140-433e-9466-a3bf8bf45e6e", "value": "T161848D06E652C03CFEFB04B8D496CA66ED5E3A24169D619F63413A6D32613CF123F52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644333963, "uuid": "b5dacc9d-dbfb-4b82-bb04-149b34c665e7", "value": "79fb40281049052b3e354a6e444da473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644333963, "uuid": "d4fdd45b-4532-4641-bff3-1a8d70d859e6", "value": "6144:O56dLjBFLyztOoEeYIjAmkB8lebi9JqGXdZ32mneM0laNUIbeURK46:YszuzNHjWB8f9JqQ2mnB0l4UMK46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644333963, "uuid": "8ee1ca09-403e-49f4-9f39-4bdd67c7d877", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644333963, "uuid": "4becaf8c-73bc-4fc5-b265-88ffcfa9ab15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644333963, "uuid": "769be64d-1424-4bf5-89bf-2aff671e5a2d", "value": "3dd56c5e9310a30a23dd3996a7265a8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ceffe9-8902-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644340394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340394, "uuid": "b8154402-99af-49ea-bf47-e398b178c608", "comment": "Malware payload (Heodo)", "value": "4f3ab0b4a60c92a52e01d9b2e5200d73", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340394, "uuid": "55bd7b66-7624-4b95-b85f-2be1d1341c3c", "comment": "Malware payload (Heodo)", "value": "457b20f937b7ffb7bd743858812a767e14eccb7d5b0d3c8286870928be3223a0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340394, "uuid": "a451211f-c973-4353-a0bd-f3f344b01496", "comment": "Malware payload (Heodo)", "value": "c69c9a8815e803d3b0ea9d512cac7b30badb9439", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340394, "uuid": "725b97e8-832b-4f6b-9c9f-f31e4862d5ed", "comment": "Malware payload (Heodo)", "value": "cdec0dc5557a6d94dff09fe56cc84958113ec3bd76f6760284ced5a44b911683b1ad837ae7e0be7bb5ed379b9a503e44", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340394, "uuid": "b24fb2e7-167b-465e-ba5a-9a86245e14a0", "value": "T122C35A55F685EA1ADE0823350DDFC7F9733ABC828E9683473289B32F7D76550CA12606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340394, "uuid": "a96adcf6-a9f1-4584-b6f6-cd3b9f0ae4bf", "value": "3072:3jAcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dg31:3EcKoSsxzNDZLDZjlbR868O8KlVH37kW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644340394, "uuid": "82e1b7a6-e292-4239-965f-5fadbbb28c71", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644340394, "uuid": "722d10ff-cee2-4ae8-8462-8da9c73d16f1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340394, "uuid": "d33d2135-f4f0-4f6c-9565-7314c80e13f5", "value": "tmpop__xjks", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f2f93d-88c1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644312360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312360, "uuid": "faa011f2-aad8-4eb7-9233-a1cd08dd7755", "comment": "Malware payload (Heodo)", "value": "60cd07e5cfaf7e3b5b1595a97027cbd6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312360, "uuid": "e8625072-df1d-4714-a376-487199fb3daf", "comment": "Malware payload (Heodo)", "value": "4611187943a0608262a932224ebeae0ab230f19a11aa852ea186b891a9a59293", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312360, "uuid": "7d9ef8bf-1e98-4e15-b16a-cdf16866502d", "comment": "Malware payload (Heodo)", "value": "ede5aeda06813cb8585088b87b6f3cf73533d662", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312360, "uuid": "98a6dc2c-eb66-41c3-a824-346ada8b4ae0", "comment": "Malware payload (Heodo)", "value": "93fafe383d6e16a8ee09f1fe3614ecb071ee5265b04b5f0c556083dc69615dcf55391cac1d06b480d0ed14ebeecefd43", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312360, "uuid": "cd935b31-5e7d-487f-b72f-49a94964ceca", "value": "T1F6C36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312360, "uuid": "88b5d14e-7f61-44b0-b878-82eb099b43da", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644312360, "uuid": "bf4b8b2b-7844-4491-9f54-df507cb9be6f", "value": 127672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644312360, "uuid": "3d05a044-1de0-41e7-b4d0-d9145ea5e144", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312360, "uuid": "8cbafa23-fca2-4c3d-bcc9-c5ba9c8a9c94", "value": "MES_149.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e558ccd9-88c5-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1644314407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644314407, "uuid": "989337de-0003-4d67-9ddb-c5c18a88344f", "comment": "Malware payload (RemcosRAT)", "value": "01e32eb635eb314bde9ed6625c859ec1", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644314407, "uuid": "d4284ffb-411a-4678-81bf-46e557512620", "comment": "Malware payload (RemcosRAT)", "value": "462432376eddb58976b2e37d005fa536e8289e0f1224f0292b2fc748f6e70691", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644314407, "uuid": "3d2f2453-3b3e-4954-a887-c9c2a80361d5", "comment": "Malware payload (RemcosRAT)", "value": "331e548b01cbf10d3d531541a45ae181a87fc4c0", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644314407, "uuid": "2178ead6-3815-4b39-99a4-2b607191b518", "comment": "Malware payload (RemcosRAT)", "value": "2cebd843b7e6fa7fefd2a5dbe36c06449f850a587c7c784f17525c2286a39cd518684ce701674fa8187455e99f516a66", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644314407, "uuid": "613dde7a-7a4d-476c-8dde-a98cf2c95a08", "value": "T106D423A58E9DC03C8F9250D549182AD5E3F45206D1E264EA1CFDF06CE4A4B9C9DEF2F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644314407, "uuid": "b3e08d6f-d94c-4d19-bd04-9f04c96a1454", "value": "12288:573YAx8nj6a12OQUqr2OCdcONP3VxyJmrp2CKgG3WnXhoiTRd1YznShn:B3+B1eScOVFxuhCpGKJddujSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644314407, "uuid": "79edea75-5fd1-4ee5-997b-4305e3660a38", "value": 597968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644314407, "uuid": "acaf1fda-53d4-46e0-9ac4-d8d87fffd31a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644314407, "uuid": "d7014d67-c180-4dc5-bcbf-983399f16c23", "value": "RECEIPT-IMG303948485.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acab1663-8895-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644293697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644293697, "uuid": "5ce38e60-dff0-43d3-b01e-fc926fdc4038", "comment": "Malware payload (Heodo)", "value": "4292ff987b6a6627df96152a6ddb89fa", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644293697, "uuid": "9ff7993e-dab1-4f7e-af73-478c47016a79", "comment": "Malware payload (Heodo)", "value": "46355eb79cb65f448a25ae380fdbe0cb616c8a83e135bf7f774712ddc570c92f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644293697, "uuid": "1ac0c034-c463-46ac-9c0e-a8853f552af7", "comment": "Malware payload (Heodo)", "value": "0c7a38d3a878b5d75e1064f4fae14328f187b74c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644293697, "uuid": "15b2ce40-0cc3-4207-84bd-a88705d3cd5f", "comment": "Malware payload (Heodo)", "value": "780e528b09e2cf30242c68bf2b2709b6b67afdf05dbf4ec775efa114a5814840bbd3b649afe6135f95f958f133a6bd45", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644293697, "uuid": "8b97261a-03a9-41b9-84eb-76bf52fdfc7e", "value": "T112D38D6ABA48CA0BD94913314EE7CBF67335BC819F5297473295B72F2D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644293697, "uuid": "036e0dc5-d046-4835-aad7-eb2094d1b742", "value": "3072:BcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3v:BcKoSsxzNDZLDZjlbR868O8KlVH3skeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644293697, "uuid": "9c9ee812-293e-43b4-b0d9-73b6fd7b15b1", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644293697, "uuid": "a183a998-22e2-4ae2-9ba8-f124d0469044", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644293697, "uuid": "e99de613-a556-4e37-b1cb-ef6830f9bf5d", "value": "tmpjwnaienw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee5af78-88fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644338073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338073, "uuid": "3ed913bb-d65a-4e37-8175-da8fa64c7f03", "comment": "Malware payload (Heodo)", "value": "f41f48ebd65bd3ea4e14c8d2ac5651cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338073, "uuid": "712c56ec-13ea-4ef5-8b16-d291af70c59e", "comment": "Malware payload (Heodo)", "value": "46393084866e41338a3e912ea05e2edbd183b7a673250651b3a43924f15c590a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338073, "uuid": "680eb19b-addd-4a19-8cfb-2976680aaf63", "comment": "Malware payload (Heodo)", "value": "5936ff1edcd78504681c1f85b3e96ca96e708b28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644338073, "uuid": "f04bb3bd-6875-41f4-b8a0-8339f6b3462b", "comment": "Malware payload (Heodo)", "value": "04d779e429f8221ebabf768bb6cc3595611537f3ce79ae445815fb82a7a719a75f2ff6914e27907be178fc4dbacc65cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338073, "uuid": "88a8ad1a-2473-4ea1-a8bf-6b9da627c893", "value": "T12AF4C0006582907AE4F930B842667BF1E93D1CB0372511D39BD069FEA6E41F1B6B376B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338073, "uuid": "bed63265-f138-4beb-9875-f3bca86690f5", "value": "36d18f8cb3bee16af0421e6a936157a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338073, "uuid": "9b5f7ada-5382-4999-9783-816988e9404f", "value": "12288:lBseOTwOg957PAMTEFv49thrFcmxLFwD7wGcXbtzbEOpUDlBGawsoei4:keOTwOUPnTC49LJxJwaCOpUD7xoei4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644338073, "uuid": "8f1d0456-39a2-4b59-9311-3fabe45629c0", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644338073, "uuid": "b5e1a1f4-ef67-4db3-8376-9834aecb0d58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644338073, "uuid": "e233200a-730a-4d14-b439-3a672fd1f62d", "value": "f41f48ebd65bd3ea4e14c8d2ac5651cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4589420c-88cc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644317146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317146, "uuid": "642e1804-44c6-4103-85fb-235825a871aa", "comment": "Malware payload", "value": "1e437d8cb03950655d38a310928de43c", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317146, "uuid": "de842551-0827-4cba-b57b-fdc64eb42da5", "comment": "Malware payload", "value": "46828fb51abae8b9ca21090f56d90d63270464318cd81235872a8fba35ce3064", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317146, "uuid": "b8087d20-65ed-4b38-9113-8122bec085c7", "comment": "Malware payload", "value": "132f70beccb2f78d602ce259cd7f33dff8e3ac8c", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644317146, "uuid": "67b22f90-2933-44d2-89fb-4bb8df0f9e18", "comment": "Malware payload", "value": "66d23c371a6bbc620ac89d7717cc2813537775fb2b406769e90ef30503181680124bdd9fd32c3a06f72470f34893b454", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317146, "uuid": "7e37d1da-332c-41f4-a2e1-51726b92cf67", "value": "T1AB74E16787560888FC83D2B4C0DA377D1AF9355BE2ED5ED319BC61083902760BBB2A57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317146, "uuid": "f2a0868b-ac4e-4025-b83f-444124cc5469", "value": "6144:gTTqq1Ct4FVvbZuqxS1z+9OR0ZFNPZ9Ia/:gTOq124FVvHe+lZFzm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644317146, "uuid": "6fea1964-196c-4e73-a866-caeacbf16b57", "value": 370873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644317146, "uuid": "8a4994b2-a2d1-4c91-a503-f42b9582c555", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644317146, "uuid": "aaf431a8-adef-4b86-8c3b-e2da4ec96be3", "value": "46828fb51abae8b9ca21090f56d90d63270464318cd81235872a8fba35ce3064", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26282723-893b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644364767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644364767, "uuid": "2dab5208-c2b5-493d-81cd-e8fd72ef42e2", "comment": "Malware payload", "value": "56ddf50d4a420d26ab301e7c315c74e5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644364767, "uuid": "9948cb5b-5ee7-4609-90c9-40959b685a87", "comment": "Malware payload", "value": "469178629ba9296b64e12f07d53e5e21ba3b70cbf7c761a2d7eaad5398d83020", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644364767, "uuid": "351466a5-0767-4320-a875-3d34bb8b4093", "comment": "Malware payload", "value": "fe726a700adb38beb157e9a15570ef27ff292005", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644364767, "uuid": "47524e21-9b05-4931-81d7-1ab4daefafb3", "comment": "Malware payload", "value": "baaeaa92d08c29d8eb64bcb00458e6fdcffdb1cdd65727769e80b3ed5060c58b2378eddd8626fa398bea67a867d178a5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644364767, "uuid": "5a47418d-8e80-4936-9fa7-6b6dc8e5ce95", "value": "T170C35A55F685EA1ADA0823350DDFC7F9733ABC828E9683473299B32F3D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644364767, "uuid": "02f1b896-a375-4e01-a0e1-69068dff1e22", "value": "3072:cIcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgiB9:vcKoSsxzNDZLDZjlbR868O8KlVH37kew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644364767, "uuid": "55260ade-0079-47a6-8f80-54cc8e9ed9a8", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644364767, "uuid": "f921e696-5829-4d3a-a0ae-fe1faca8ace4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644364767, "uuid": "21bc1acb-d2bc-4145-87f4-10ac7d6a43ab", "value": "tmpnxlvx1go", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0591c2d-88cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644318613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644318613, "uuid": "e7084376-8fc2-4e01-a62b-93fdd2004ac7", "comment": "Malware payload (Heodo)", "value": "c9024e60b928b70cdbe89e63dd1c88da", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644318613, "uuid": "c57f80a8-d458-497f-a6e5-52383e831738", "comment": "Malware payload (Heodo)", "value": "469dca62d8d072c04c1a617a3f8da2ab208f5d8a6e3613f721833ea3fb8e2147", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644318613, "uuid": "e5586e1d-9e85-4320-b29b-23b5ad177e4a", "comment": "Malware payload (Heodo)", "value": "e749afaf5bcf0e42cf4573e8ae7246eea112335a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644318613, "uuid": "fe0d2256-9a04-41b9-9f1f-1d3aa575cc6b", "comment": "Malware payload (Heodo)", "value": "cade3dde8a4e2e369bc95ef01b188d7e14e72f1c3eb8256521ca80e5d919b8de8d920686caf927f38d75fae4d8196c2f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644318613, "uuid": "1d534cd9-e7aa-4d72-a8f5-2cdc26aa0ba8", "value": "T130C36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644318613, "uuid": "2a884771-3be3-4d53-a4fc-8bd8e9b22bc3", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644318613, "uuid": "b035f49b-0ad4-4d23-9b04-8807f88794d0", "value": 128404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644318613, "uuid": "3c1491b9-96f1-4983-8f2e-1ab433227a52", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644318613, "uuid": "0a79c041-280b-478e-a57e-3a9dc1f23e56", "value": "tmpga04fsgg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce78400c-88c5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644314369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644314369, "uuid": "b9a54234-0b3e-4068-93ca-63bbe47ba326", "comment": "Malware payload (Heodo)", "value": "03f011b9d4f9f7bedf33a571a49ec74c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644314369, "uuid": "26758a1c-d97d-473f-9a9b-3c459d41c7ea", "comment": "Malware payload (Heodo)", "value": "46e4d571a8355d38a4bf44ef7c8ec61359462a63c7fe01e51d28afef4a51d9eb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644314369, "uuid": "9d886da6-c9b4-4c90-bdb5-eb93683105a4", "comment": "Malware payload (Heodo)", "value": "fb48fd1fc5bd23185a4b4b617cae83c93ef5dd3b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644314369, "uuid": "9ebc7572-916c-4dcc-946c-0d8b95a54515", "comment": "Malware payload (Heodo)", "value": "c9cd5677fa4d3cb8d34013e425fb627dd45bb19951d7d248c8e065a27df3b7d1660ce62d6eff3fe7cc0490fe9fa8da39", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644314369, "uuid": "664bb1e7-a87a-484f-9e71-d837b0ea459e", "value": "T1F493499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644314369, "uuid": "2161a36d-7a5b-46b6-bf51-02db1f293ce0", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644314369, "uuid": "56bf8058-3640-438f-b710-568d713c3779", "value": 96887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644314369, "uuid": "9b89e7c9-eaf5-4526-9220-403e33f3b318", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644314369, "uuid": "5ce59d80-c2f8-4e3e-914a-8ea662a9f32e", "value": "tmpi33qlys4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5714d2e-889c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644296745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296745, "uuid": "3317623a-fd9c-41ae-9421-9e32127d57ae", "comment": "Malware payload (Heodo)", "value": "6db31d2117f4392c41e9a0beb0439934", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296745, "uuid": "5fded71d-9dd1-4384-ae41-38349aac2500", "comment": "Malware payload (Heodo)", "value": "46e5d2532b038254e4c2ef3097f8624fff2f08bb72d9f9777b1271a55ffd74ff", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296745, "uuid": "dab5785e-5004-44b5-ac41-9ceed6f10057", "comment": "Malware payload (Heodo)", "value": "ad340641634d14f634dcc0128cb61b1c9a7a4248", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644296745, "uuid": "8e80e098-ad03-4db0-a6f0-586a43582115", "comment": "Malware payload (Heodo)", "value": "00f47f210bb36c6172cd3ceb20b1f5b0573f1a52632c724d27749314ef11c4a65ad12297382d079809b5b0d8172d6ffa", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644296745, "uuid": "d5bde670-8e31-422c-b382-63f48e3bc5b7", "value": "T1D8D38D6ABA48CA0BD94913314EE7CBF67336BC819F5297473295B72F1C3A590CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644296745, "uuid": "d4a8337e-9fad-468a-b424-bfbf1ad74e54", "value": "3072:hcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3P:hcKoSsxzNDZLDZjlbR868O8KlVH3skem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644296745, "uuid": "c4fc466e-edc5-4331-ac9c-42d9529d0b31", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644296745, "uuid": "568825eb-2a20-4ad2-9b6b-391e8a076589", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644296745, "uuid": "088d2214-7ee3-41b9-addc-ba8b3d92d300", "value": "tmplra0ipir", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e91003b-8912-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644347172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347172, "uuid": "a379a1b9-3a80-4d68-a0a0-80629ce2620b", "comment": "Malware payload (Heodo)", "value": "da7129139be2eabf0e35fcc20f943c28", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347172, "uuid": "9a59d41c-ae71-41c9-ac0f-6e4387cccf11", "comment": "Malware payload (Heodo)", "value": "46eb4fe9c2e49e27110649819450869298fe15b17d7753b5d4a05bda4ebe5949", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347172, "uuid": "41a28d92-4921-407e-99c0-dc193ae29763", "comment": "Malware payload (Heodo)", "value": "07f58ba160659d856d7898b78e7d75a0f74dbd3c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347172, "uuid": "dd57cb72-ae97-4309-819e-bb7b828655b0", "comment": "Malware payload (Heodo)", "value": "5dd0e62f706acb6dd986dbd54fdc48e7d69db608e68e4ec7c422849b2c0fc1c1ae6528dd1f96de7648367fbb43fa2c7e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347172, "uuid": "c3981202-fa8f-477e-8145-116e422e4bd1", "value": "T1F7748C41E952C03CFEFB00B9D0D6C62AAD1E2E211B9D569F6244366D36603CF163F62E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347172, "uuid": "be378b23-94b9-4365-91ff-bd8478a6309e", "value": "79fb40281049052b3e354a6e444da473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347172, "uuid": "777976f0-b6fb-4398-9caf-335351e438d4", "value": "6144:YFF10hIGpvZeY+wBuBqtrgummwYT4ahREWkOieUR6:yKIG5KEnmGcKS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644347172, "uuid": "019dda16-2a8a-48f4-8264-559c3b00ddb2", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644347172, "uuid": "6f313a6f-df5b-42cb-a5ca-1e578dd7e4ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347172, "uuid": "1bb19338-2cb7-4f9e-a295-2fd8c8e540ca", "value": "emotet_exe_e5_46eb4fe9c2e49e27110649819450869298fe15b17d7753b5d4a05bda4ebe5949_2022-02-08__190558.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7643b70-88be-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644311297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311297, "uuid": "ff234b65-96ea-43f3-b2c0-c36d87581aa3", "comment": "Malware payload (Heodo)", "value": "625e67bab3055462f3e698ff7a5dc75e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311297, "uuid": "a72782a2-8acf-488a-bd61-2a61f0e49648", "comment": "Malware payload (Heodo)", "value": "472b0a91fbca22acc60f0270a1944f7dd4c92757eba0a10f1b564ffdee59e4bb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311297, "uuid": "cceff9d6-a97a-45f9-bd37-96d8119af665", "comment": "Malware payload (Heodo)", "value": "1774a2a9e04a73996d5fd9b397ef119420f9bc01", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311297, "uuid": "c89c980d-c23e-4809-bfc9-64bc6a07043b", "comment": "Malware payload (Heodo)", "value": "87c011be82908feefa6cb6718464b6e9b37f49d7dee8a9ebce2a36f88733565cb3468a725b73f6a4e025919c25eb361f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311297, "uuid": "6c8949e6-a51e-4a02-b5a1-0754d926beb9", "value": "T148C36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311297, "uuid": "25b1a467-7d8f-4e71-89a6-b1b51e8c7a2c", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644311297, "uuid": "65ad3e25-a068-4632-8e50-674a18b5b2f3", "value": 128208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644311297, "uuid": "9bea43cd-753a-4cb2-898c-ff8588e385c5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311297, "uuid": "b5de6b0f-81bc-4efb-aed3-eec66900d991", "value": "tmpvwnrbpwa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60486b38-8917-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644349403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349403, "uuid": "f9f8b343-a271-495b-9ce1-8f013614867d", "comment": "Malware payload (Heodo)", "value": "c802df41ca8821cef10d3d69594c5653", "object_relation": "md5", "Tag": [ { "name": "5", "colour": "#9EC247", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349403, "uuid": "2461c5f4-1588-4833-bc5f-312e5c4f0ab8", "comment": "Malware payload (Heodo)", "value": "4736cfdb642565dabd7d49465389dda11921312ef31749f47896ed46bd9d7c81", "object_relation": "sha256", "Tag": [ { "name": "5", "colour": "#9EC247", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349403, "uuid": "ef56808d-6f90-46f1-99f5-3f4fef11cb44", "comment": "Malware payload (Heodo)", "value": "2671019495baac2f53e3760184cce0768671ddf5", "object_relation": "sha1", "Tag": [ { "name": "5", "colour": "#9EC247", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349403, "uuid": "2507f75b-9b65-4033-ac7d-d97afd164e63", "comment": "Malware payload (Heodo)", "value": "609cbc26ea6f212a39407f404c49c8a51d8e144f047d29d36accdb921f72482af2a93ef185eee15a2a2fde0c698a36de", "object_relation": "sha3-384", "Tag": [ { "name": "5", "colour": "#9EC247", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349403, "uuid": "7220268f-19e1-4229-99d6-6bb9588bd388", "value": "T10CC35A55F685EA1ADE0822350DDFCBF97336BC828E9683473299B32F3D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349403, "uuid": "31ceb148-234c-4ba8-ac57-1063e8ba3207", "value": "3072:w8cKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dg+BO:LcKoSsxzNDZLDZjlbR868O8KlVH37keD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644349403, "uuid": "5ef157f1-09ba-4a04-aafa-cec8debd3341", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644349403, "uuid": "2560465b-46e5-4f5d-9b2e-b9b2702c3878", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349403, "uuid": "30ae6fd8-4ed0-4c46-aa67-ee4e40249a40", "value": "tmph8wl_q26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a16c3089-8881-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644285088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285088, "uuid": "8d2c5eb9-3fbd-46c4-822a-4f36f4cc4bfb", "comment": "Malware payload (RedLineStealer)", "value": "02221cb9236676a6efeacfcecac2f616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285088, "uuid": "8aef4bed-dbfe-4415-a721-27ed1dd78801", "comment": "Malware payload (RedLineStealer)", "value": "473803394093545e6538b4405873a1e1c484416eaf2fd44b406f0130b597c842", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285088, "uuid": "c8787495-3829-47ba-8f30-20bc7d729dcc", "comment": "Malware payload (RedLineStealer)", "value": "53b069ab9784223a871e9ef3c21a630ddb46d1a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285088, "uuid": "b563cef5-dac8-44f8-ad6d-e7f7c9eb3d9a", "comment": "Malware payload (RedLineStealer)", "value": "7ef22ce141fa83ca7a215b12ccbf1f85e15990cdca322d58f7668ffa0caa2852f066ff5cf8fad97d5c19b3fa29f9bca4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285088, "uuid": "e5ce1052-574f-4049-96af-cf03400bf153", "value": "T1D625232585C1BA3BE0E467B122D0E1B37776AAE01B8B1BFB94DE45E998303D2513D14F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285088, "uuid": "009dba5f-ac3f-4153-ace8-4a38e45dfd6f", "value": "0ebb3c09b06b1666d307952e824c8697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285088, "uuid": "fd3b8d78-aa55-48f5-90ab-654ed3f34592", "value": "12288:2UIPrQ4BpFl2l8MJNSp33XUQFBXmQhB9WzsSSDna9H1jBm11+q4VWvr8aXxAYs:2vPhbl5MJa1DvB9cs/W1jBm184tW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644285088, "uuid": "51bd4ae6-0572-424e-baf2-23ca907fa241", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644285088, "uuid": "b019b8e4-340e-418e-b0ae-b03944a9f340", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285088, "uuid": "10d9b2d2-8f16-4eac-980f-4f00bd37c009", "value": "02221cb9236676a6efeacfcecac2f616.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ffd848-88be-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644311075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311075, "uuid": "6c0e175d-0532-4967-9ffe-29c661d4e4cb", "comment": "Malware payload (Heodo)", "value": "46ba468de6f0de4ee2fbcfe5cbdc8368", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311075, "uuid": "1aa8517d-eca3-4156-83ab-613fe6bac3ab", "comment": "Malware payload (Heodo)", "value": "473e0b9389467d6a6d7bc0f2eb8477164684393178125b712f5f3fd572349458", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311075, "uuid": "b2595775-9ac3-4271-91c7-a13290605ca2", "comment": "Malware payload (Heodo)", "value": "33272acc4a522fd6e38efcf407fc361b27d1801f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311075, "uuid": "50b1b59e-5beb-4b33-9d4b-009af22c52f8", "comment": "Malware payload (Heodo)", "value": "fdc554e41104d64cf42d0bdc8b2a0a93fb8ccb6fed6021f75475f879e0459d8cdf78709a831cab7a5da54a5ebf0a29a1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311075, "uuid": "5eaf54e0-98d1-492c-b7fb-8ea8eee97bfc", "value": "T10493499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311075, "uuid": "ba49d798-2a17-4d25-8014-6597616e9900", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644311075, "uuid": "d9730630-8b1d-49f2-a96c-c574afb9080b", "value": 97354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644311075, "uuid": "1097053a-9aaf-4caf-a00a-81ec14f62785", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311075, "uuid": "090d3c0f-11ef-41da-b149-2d073ac8d29d", "value": "tmpz3f3zd6y", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f125b6b-8911-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644346743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346743, "uuid": "d46f98a5-b345-47ac-9fd6-7dd1dcca9ea6", "comment": "Malware payload (Heodo)", "value": "aebb4f79340f992ce782249f76795b4e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346743, "uuid": "77838916-c0a6-4524-a970-15a2ce1537f7", "comment": "Malware payload (Heodo)", "value": "47added8dd1d4254f70d91e35e6fbcfbde06eab1f03601167767760ef30aae25", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346743, "uuid": "018fef0a-5f95-480e-848e-e34a666d0348", "comment": "Malware payload (Heodo)", "value": "e9b3486f2cdb6628f2fed48106b055a47fe88665", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346743, "uuid": "3a9f527c-b35d-4938-9e7d-f712f182b1e9", "comment": "Malware payload (Heodo)", "value": "0090c19528e565b4ed1b5c9f762078a8cf0cb3ef2f2bf7387ac346bfa71c8530e0676b4c1b69a464cea34eaf8d322bec", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644346743, "uuid": "5b350e74-dd4b-423d-91bd-e0b483f812b5", "value": "T1C6C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644346743, "uuid": "e074e31c-b373-4460-b3df-b4e666db4d78", "value": "3072:bxcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLB3:lcKoSsxzNDZLDZjlbR868O8KlVH37ke7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644346743, "uuid": "48752be7-a37f-4d12-8956-8ef9920802a8", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644346743, "uuid": "03921ba3-dfbe-47ef-b46e-c2363b9ebd88", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644346743, "uuid": "f1d45f53-3808-4ffe-b2d2-12b5d6c97a2f", "value": "tmp3w8_6ec9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0bb4e9-88bf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644311711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311711, "uuid": "6e50bdb7-4264-4367-9d76-9b80f6b227ba", "comment": "Malware payload (Heodo)", "value": "3e39f0c16fd6c876c87021c0d5fa8c6a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311711, "uuid": "19042ddb-a7fd-4194-9242-5c9316d2e932", "comment": "Malware payload (Heodo)", "value": "47b4f7760514141a357aa10460236769f23fbb4526227ee0e289b503b83b8920", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311711, "uuid": "436105a3-8d90-4f4d-b0f7-24a9fb2b97f6", "comment": "Malware payload (Heodo)", "value": "dfae4e49cfd743aa4d54222268e89ce054173038", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311711, "uuid": "a19d0b61-43e4-4a5b-bf5c-1f272c87b2cc", "comment": "Malware payload (Heodo)", "value": "df55cdc6e890ac5256fe2a470ea48d8c8bd875e2dd543ad414fe958da584551a4cf598c31339d3ae2c5b23f84400fe2d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311711, "uuid": "7ee818de-bca6-42d0-bcc3-2914417199da", "value": "T17493499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311711, "uuid": "1014b626-70af-4fec-93d6-65888d479e1d", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644311711, "uuid": "b92b3dec-5fbe-466b-a401-8c74a8efa2e9", "value": 97313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644311711, "uuid": "56776748-65ad-4d57-b27c-e66a24311993", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311711, "uuid": "f0edbe6b-44e1-4158-8c92-608646dc5949", "value": "tmptrllnyhn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31810041-88de-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644324843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644324843, "uuid": "f2db9d03-2ec9-487e-9ab2-18ba04c6779e", "comment": "Malware payload (Heodo)", "value": "08b8ef3a92c020915d5d3c2c36ebdc15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644324843, "uuid": "2a49e8d6-9e80-41b5-960c-888e800f2401", "comment": "Malware payload (Heodo)", "value": "47c31ebfb52cf31d240433c9f9efd6ac1d6bda269378a6f3c1db9d7afec0c88f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644324843, "uuid": "7834e47e-9ed9-4b6f-9530-ab9c037c5fa1", "comment": "Malware payload (Heodo)", "value": "13b4603458541f0337b74a66795305d9aa435ada", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644324843, "uuid": "f815f1cc-d1cd-4c9f-8543-e6b96655bce3", "comment": "Malware payload (Heodo)", "value": "66b29ab616771399de63d4d609d7d02b9a4d1cd099784bb735ee8f0b3653f4d63b16b896f513a59ca3e826855ee4ae68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644324843, "uuid": "3fc15dc3-69d6-4d7b-a78f-edfdb05114ec", "value": "T10CC43A12AA82B0F1C79C813EB3F97AEB903F146547AA76D34FB18C8965EC0D119F7911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644324843, "uuid": "90043978-8ef6-4e2b-94ce-d25d0c74c800", "value": "1059dec3a72d4c311e39c8fc33d5af98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644324843, "uuid": "e989ef9d-4eff-49d8-80a1-afa4b36f493d", "value": "6144:PQXvqLl4JINqB9QqbJq9AbuR/RzZ+fR2c96lnVPk5XtlOkiETHyROnR:oXvQDQVq9Ac5ZuRP6lRkzloEzyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644324843, "uuid": "7007ed2b-4f77-4e06-b896-ffd767a4b050", "value": 596992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644324843, "uuid": "fc878990-5852-4a2a-b362-a58b248e11ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644324843, "uuid": "233ec514-3566-4262-858d-01231b8b6a3c", "value": "08b8ef3a92c020915d5d3c2c36ebdc15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd91f48-88b2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644306206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306206, "uuid": "28593712-7fe2-42b2-a8b3-cde577e547e6", "comment": "Malware payload (Heodo)", "value": "3138bc92cff6609361200c46b3604b4a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306206, "uuid": "90d14e28-3439-47ee-a229-2e9c0547629e", "comment": "Malware payload (Heodo)", "value": "47d1450aca1d11c2fae56ac712faa5e1ce773d0c89b2663aa962a94c0367d614", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306206, "uuid": "46bca920-77a0-4f84-bd2f-b3fce061650a", "comment": "Malware payload (Heodo)", "value": "7ce91f6122095837c35ee0bd1e438a2261f5ab4e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644306206, "uuid": "00f0569a-6038-41a5-ac94-81e982a62388", "comment": "Malware payload (Heodo)", "value": "4a0b37185e564d295ab9d74978fc857e6571b104ca63a6c80f3e434439a17cbb5fe754d0ddd5fc8a2dc4064cbcf979d3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644306206, "uuid": "426e1ba1-2a69-4288-bb82-d55107770278", "value": "T12693499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644306206, "uuid": "b38078b5-c5a0-42a4-ae0c-3759f8eae69d", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644306206, "uuid": "cd561e5c-8599-4756-b097-f3697f8c6cb6", "value": 96809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644306206, "uuid": "f3ece1cc-c49a-42a9-aae3-26823315067a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644306206, "uuid": "cca7114e-4f72-4115-a8bd-a7be7c7a298f", "value": "tmpm8eex7lb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d121319f-88f4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644334560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334560, "uuid": "c48e5208-7e6b-470a-8c7f-bc4a5beb3e29", "comment": "Malware payload (Heodo)", "value": "fb78e79dc5eb27f72af72ae86b6576e8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334560, "uuid": "f507c0de-e5a1-41ba-ab70-6049faf4e240", "comment": "Malware payload (Heodo)", "value": "4838b588a9900ce5f135a4565d347e5d0102ef1c3b3840ecc2bd5f7097026c44", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334560, "uuid": "4798ac47-fabe-4d81-b604-76aa07e93f34", "comment": "Malware payload (Heodo)", "value": "b30ef51633a94a2a252cd4e54f040016c4a07b6a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334560, "uuid": "4b729757-87c3-4f79-90a4-17a264f8ce5d", "comment": "Malware payload (Heodo)", "value": "fe620fd766696fe37c3d0cf23191407186c12dfe6eacc0d2421a27d152495115aab05d25d83618c7f98f4117a4868c0d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334560, "uuid": "3779e11e-5af4-4535-806c-f563dc11ac40", "value": "T1BAD38D6AB648CE0BD94953314EE7CBF67336BC819F5297473295B72E1C3A580CA03B16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334560, "uuid": "73d9db02-9d8b-45e1-a01e-4118808fe17d", "value": "3072:CcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dg5a3D:CcKoSsxzNDZLDZjlbR868O8KlVH3skeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644334560, "uuid": "a8198c4c-f54f-4311-98ef-b4be1fefb6b4", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644334560, "uuid": "d17491c2-9dd6-4b34-969a-58b6081b8cf5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334560, "uuid": "9b5ec828-1953-4ec7-824d-e1d4246f373b", "value": "eBooks_18.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4972c7b3-8894-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644293101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644293101, "uuid": "5c7db7ab-1ff2-4e99-a7f8-eec9a00e16a6", "comment": "Malware payload (Heodo)", "value": "d6009b2f86dc8661719c7a3a9fcef6bc", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644293101, "uuid": "b197d50e-e68a-4156-9d7a-f00054296c4f", "comment": "Malware payload (Heodo)", "value": "486ea54d610f4316beb62a874cc5dee7ac5fca5d98e5bc1b9a95e5b253fe2902", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644293101, "uuid": "f1508725-57b3-4f0f-8c28-beb68679c3d1", "comment": "Malware payload (Heodo)", "value": "2ef372d8768998cdf2840fb62cc4bdfe16ab12db", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644293101, "uuid": "fa973675-6204-4e07-80ef-e8b074166e77", "comment": "Malware payload (Heodo)", "value": "ae968e8b1d9cbb46ed39d2d04646c1d1109c2c8faccd250bd8e7e6e8998eab84f9ffdd48933d0202f6e39e8e87b1c18b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644293101, "uuid": "91d3c036-8e67-4cec-af0d-9b6d96fab7fa", "value": "T126D38D6ABA48CA0BD94913314EE7CBF67336BC819F5297473295B72F1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644293101, "uuid": "b4ac9244-2150-4ee2-9636-0c12a99ab8c8", "value": "3072:9cKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3S:9cKoSsxzNDZLDZjlbR868O8KlVH3ske/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644293101, "uuid": "f2ecd12a-08e1-4267-bf8d-c5961b3b153e", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644293101, "uuid": "d1eadf25-aa44-4a41-aeec-7e9c82449bcc", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644293101, "uuid": "1f2afe4d-0927-4f9f-acb3-01d2a775828f", "value": "tmpwxkodq6x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56bfbe34-891e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644352393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644352393, "uuid": "5077daf8-d4cb-4fa6-8b19-ac8462e20fa7", "comment": "Malware payload (Heodo)", "value": "aa614ee46bf0c7f62c07f6921dd3e3e9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644352393, "uuid": "bc1ed7c3-862e-4537-b3f4-59339709e02e", "comment": "Malware payload (Heodo)", "value": "48b5596a25849f728e8327fcdc191a4131f886236e69040813a7d593599d47ed", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644352393, "uuid": "4778db63-cbf5-4098-8903-09ac7f63e7a7", "comment": "Malware payload (Heodo)", "value": "0aef031bffc89b9ce4edede18531605899fc5575", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644352393, "uuid": "612d1654-3b88-4d2c-b284-95001e2790f0", "comment": "Malware payload (Heodo)", "value": "6447ec4a13a7f827d7eacd4dc3bb0e4d3bab060e2395dc7c13a97f9e8f97e196009d9c7ac215d9441b36723810487d41", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644352393, "uuid": "f58e3664-8322-4716-b0b5-2c89c0c1dd7c", "value": "T153C35A55F685EA1ADE0823350DDFC7F9333ABC828E9683473299B32F7D76550CA12606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644352393, "uuid": "106199f5-34f4-4ae7-8f60-a9a01c116937", "value": "3072:SUcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBn:pcKoSsxzNDZLDZjlbR868O8KlVH37kej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644352393, "uuid": "785e89f0-e9ea-4a52-9f41-7f41f002731a", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644352393, "uuid": "0fcaf622-98d3-4396-ab02-6d879eb9cdce", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644352393, "uuid": "5f7c13e8-1f00-4854-93de-94fb5f3894f2", "value": "tmpofz91k7p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96099709-8892-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644292370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644292370, "uuid": "5bd82b3c-0235-44d2-ae59-b73ac19bcbbc", "comment": "Malware payload (Heodo)", "value": "890d951a01df075f9a66909a0b41324c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644292370, "uuid": "e8ab5d08-258c-4998-b16b-061878419d98", "comment": "Malware payload (Heodo)", "value": "48bb2a667062b43b2a92ca234df6422d71f7a5280a946aa8ac9b55c2938102d0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644292370, "uuid": "aa492dc5-c4c4-46f0-98e2-b20582020f20", "comment": "Malware payload (Heodo)", "value": "8416d4f1e05cb35807e468413c586c8f71f5f380", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644292370, "uuid": "a24722b1-0cb0-42b4-8794-12f68bbef186", "comment": "Malware payload (Heodo)", "value": "f21743a05cc2c88a951c3a81aeb38562846797b47594a742f3772f24590ecffb2c09aa678cacdb888673e590efe7f8e2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644292370, "uuid": "dffd3fe7-e32c-4896-9adb-ab225789fe1d", "value": "T11FD39D6ABA48CA0BD94953314EE7CBF67336BC819F5297473295B72F1C3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644292370, "uuid": "2c59d118-fb09-4519-a3ac-98b570d36f9d", "value": "3072:TcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa37:TcKoSsxzNDZLDZjlbR868O8KlVH3skeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644292370, "uuid": "2fc0d7f7-284b-45b2-8d75-9c812d4f8e02", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644292370, "uuid": "30eaff3e-3110-4c59-a741-8c47756a9b0e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644292370, "uuid": "6b181bb7-d91b-46af-8652-8eac526e283f", "value": "tmp9oukjpw7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0592a5dd-88c1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644312314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312314, "uuid": "06f4c7d4-bdb7-4906-a051-303146e52d04", "comment": "Malware payload (Heodo)", "value": "b635cfc382d39e8abb6baa9b436da23e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312314, "uuid": "a0319a90-dffc-499a-ad29-ffb308ca32dd", "comment": "Malware payload (Heodo)", "value": "48d5ca70144fa07660310827b5ba6b61df16bdd8d1c9d6a528a0680676b1021f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312314, "uuid": "83b04af8-fd47-46f2-aa27-4c61ea202771", "comment": "Malware payload (Heodo)", "value": "66f919ed72a3ef37934b401e897239193b124e8f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312314, "uuid": "4804c4de-f466-4bc4-9509-a45b1fef3c29", "comment": "Malware payload (Heodo)", "value": "ec7e63d5d8c2b09bba9b0fbce644b64237768dd4083f83ae205ada01cc59d5f0468c9c0b83dff28273a980add12d1b2f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312314, "uuid": "12f2af15-7c74-411b-8f9d-0b314bd1ea7a", "value": "T13493499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312314, "uuid": "9a271cb0-675d-4ab5-8e7c-41ae38fb1045", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644312314, "uuid": "7d297cb9-7e3f-4483-aefd-71e29405422f", "value": 97237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644312314, "uuid": "e73794ca-a63e-4713-8861-b5fc18df41f7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312314, "uuid": "b5dd6e15-4973-4b73-8662-49e89cb825a0", "value": "tmp1n70pqqw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c85da6b-8882-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1644285509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285509, "uuid": "bfcfdf8b-5529-4780-96c7-8924e9a3717d", "comment": "Malware payload (AveMariaRAT)", "value": "ea37f4ffccc783a92c59f7de131d10fe", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285509, "uuid": "b0eacb9b-5679-4125-afb7-3cb43ebab047", "comment": "Malware payload (AveMariaRAT)", "value": "48fc2a2b117078759fb794cccdc9ed738006f81ee44bf4fff209b55667186bcd", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285509, "uuid": "b31bf0f1-98e2-4cfe-b560-209f1cdd8417", "comment": "Malware payload (AveMariaRAT)", "value": "1d5e3cd0c48a51b53425e9456c02a2578b189b2a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285509, "uuid": "8304ed6c-0cd5-4573-9030-2ec47e5f4c2e", "comment": "Malware payload (AveMariaRAT)", "value": "3e7fbe01dfe0814b0a4248ec8752828997987f0b9cbfe44b9a72fad639b65a6937f1b40e35aa737290d8ef7bb8ea0f85", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285509, "uuid": "55cc1a1c-04f0-46e5-bb6d-bd1d6637e341", "value": "T166E4BD3C69BE262BC0BAC779DEC1D437F11458A77611BE6898D703A64342B9275C233E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285509, "uuid": "79714f4f-d25a-492c-8d31-a4c53c9bff12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285509, "uuid": "3259fa59-af93-449d-b6b2-22bac6aef040", "value": "12288:LqBZRVYPkPguTFK2kkdMr7e/BOmXR755QGMP1fm68pA88um:q4sPrUi28OM5nXjhm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644285509, "uuid": "194a8c51-aa12-40b9-8e96-f9a94676e1d1", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644285509, "uuid": "5616ca74-85e3-4ef7-840a-7042284befee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285509, "uuid": "5bbbff3b-5b52-4e3c-848c-a3d832747c87", "value": "V\u1eadn \u0111\u01a1nDoc_2284470123,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f7a0d17-887a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644281971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281971, "uuid": "f6772898-fe53-4112-8e19-d90dd1fab4a5", "comment": "Malware payload (Heodo)", "value": "f34e2a9eb4c120a0a52e1363ed91ab51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281971, "uuid": "2d2054ee-e1d5-46d2-bf8f-8f5442c80259", "comment": "Malware payload (Heodo)", "value": "490c8b499e1bcd6f519147a5d98d3a821f5064e514f12c1760578f0ea22c167e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281971, "uuid": "53b70301-766d-4008-a165-55fd37e8ded6", "comment": "Malware payload (Heodo)", "value": "1227a2cac12df191436d1ccd75b644197fe01dac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644281971, "uuid": "d129e473-f406-4a14-8537-7ce309baa865", "comment": "Malware payload (Heodo)", "value": "8eb557e855a75719af0d06d64fc18c60414f5b167b9576afc0eb2681dbafa0ae4f1667b6372f84fafa8cc4ea45717cb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644281971, "uuid": "f4833694-01b4-4b46-a00a-10311b6fc280", "value": "T116D429AB3A8FA1BDF17B017A6350FB44E4D27C1A9FBD25D70A86358893F2D054F18A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644281971, "uuid": "272fb3f9-f298-498f-a390-bf53da81ef86", "value": "bf1ebe22ec6f51f906ec295a3a5c6d92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644281971, "uuid": "46063dee-04a3-446f-9ff6-ee06c29dcc09", "value": "6144:x42k6LwFPw91EDbkUE39P7pyADYzqlEDFmZ4s3wAD/cvIpxUIVZFoEXlbeZhp4ga:x409qDb109PdyOYzq393fVbeFTi40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644281971, "uuid": "cc22c94a-be86-459a-8efb-53ae2d671ba8", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644281971, "uuid": "e628ca9d-8aa7-4213-82aa-4b521735cf45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644281971, "uuid": "919518dd-8286-4127-9a50-aa5fd23aa280", "value": "f34e2a9eb4c120a0a52e1363ed91ab51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b3d221-88f4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644334599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334599, "uuid": "2faca4ca-e09e-4b67-b40f-8db8693025e9", "comment": "Malware payload (Heodo)", "value": "08e128163e7900ac4772964c81aaead7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334599, "uuid": "e9f23d4b-8b94-49ca-8d6a-77052788c1bd", "comment": "Malware payload (Heodo)", "value": "491daf6f08a73818f42cf275b0d5010133a404a41c41149fe50c7e54e9913d49", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334599, "uuid": "0137b40a-ee4a-4264-abcb-c5b1a40a66d3", "comment": "Malware payload (Heodo)", "value": "0353d70f57ab9461b5647b3e2f63e7e7900a8719", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334599, "uuid": "79cb7ced-70a0-4d60-bde1-9b36f5e6233b", "comment": "Malware payload (Heodo)", "value": "b3d95ee3a9d5697e7bd2a852f5fce6387a445f562841da50777974cfa82ec8192d189e999ca43eddafb83c975e39cd66", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334599, "uuid": "6c63731f-02b1-40eb-93c4-cda7ae77e92d", "value": "T1E3D38D6AB648CE0BD94913314EE7CBF67336BC819F5297473295B72E1C3A590CA03B16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334599, "uuid": "7c7268f1-bd83-41a6-9f9b-b3eca74cdec6", "value": "3072:FcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgFa3k:FcKoSsxzNDZLDZjlbR868O8KlVH3sker", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644334599, "uuid": "67a2def1-78a0-457d-8c9a-f26be85dfcc9", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644334599, "uuid": "b4dfd6b3-96b1-4e54-985e-78b5eb87be0e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334599, "uuid": "abccfa9e-21f6-4194-8b7c-685f556698f2", "value": "Ommega_6.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7409104f-88c1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644312499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312499, "uuid": "2074e7c1-714e-473a-9867-54071defe2ec", "comment": "Malware payload (Heodo)", "value": "f421b78f912a4076add580deca40d69b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312499, "uuid": "87680048-3cf5-4a3c-a5f3-16446034f10a", "comment": "Malware payload (Heodo)", "value": "4996b74626f2a91e28dcd182284b181274fe8eb11707a59d8f573caa30607892", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312499, "uuid": "a8702557-1c65-4108-a88c-f92a1e23f6dc", "comment": "Malware payload (Heodo)", "value": "7843ff0d66162332536ebbf880ad5c2f8f8d9a3c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312499, "uuid": "dfdda48d-6046-4308-84af-9517a675985c", "comment": "Malware payload (Heodo)", "value": "fa282242a49ee512476c074ed2b100ede47101e6bf3bfaeb85581fe3030facc595bcb9bad73f326096dc3f8b19792faa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312499, "uuid": "bdf17438-3816-4978-a9a5-c40ab4ec6f86", "value": "T1ABF4C0006582907AE4F930B842667BF1E93D1CB0372511D39BD069FEA6E41F1B6B376B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312499, "uuid": "a5f9d0ab-db72-45ed-8150-4e4e50cbc31f", "value": "36d18f8cb3bee16af0421e6a936157a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312499, "uuid": "90e46c7c-a218-40dd-b50f-29526ca8cdb6", "value": "12288:lBseOTwOg957PAMTEFv49thrFcmxLFwD7wGcXbtzbEOpUDlBqawsoei4:keOTwOUPnTC49LJxJwaCOpUD7Voei4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644312499, "uuid": "0f27b922-b468-4135-afc4-b661b3b2dea7", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644312499, "uuid": "2514c25b-e05e-4e80-9395-6c787803249f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312499, "uuid": "e27299bd-f63d-439d-84bb-44aae4de0c95", "value": "f421b78f912a4076add580deca40d69b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37143f7c-892a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644357494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644357494, "uuid": "ca01b365-e444-4c32-8240-46deec8fb579", "comment": "Malware payload", "value": "3939af6566c8715452509f1a4d7b3b91", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644357494, "uuid": "2fd61845-acfd-4a2a-81dd-fab52691384d", "comment": "Malware payload", "value": "499b5c757929defb01d859a2544ba2ce7d74ea3437c5ebec07ccc1c1ee4e12e1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644357494, "uuid": "6426c253-9b18-48d4-883f-885772ba38c6", "comment": "Malware payload", "value": "79339e95974511b2f1a1c8cc1e40a0da0c821f47", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644357494, "uuid": "e8b3524a-6b19-4565-81dc-d4c5c673da76", "comment": "Malware payload", "value": "49aee0dc21c981f1605b6248d7be4e65ddb28accabf8ad8b000fe778df7285657671afd130c1eb7387276318ffe54f0d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644357494, "uuid": "9bf2d72d-9c10-4c72-ada3-f1562a63dcf5", "value": "T10FC35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644357494, "uuid": "0f223ee1-4550-4210-a5d0-8290af18c39a", "value": "3072:tqcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBO:McKoSsxzNDZLDZjlbR868O8KlVH37keW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644357494, "uuid": "61d00f81-69d4-4048-8a89-ea0e12158175", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644357494, "uuid": "c99af91e-13b9-4f11-9bfb-fd956bf646b8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644357494, "uuid": "4e47e868-f86f-44b2-91a4-5f60f19c7ffd", "value": "tmp0y15i4hm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb256460-8928-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644356964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356964, "uuid": "3e7eca89-37aa-4ac8-86ed-9da2219fe8ea", "comment": "Malware payload", "value": "6160808d572c9ca1fc7483ba27d207ae", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356964, "uuid": "74ee304a-4a10-4e6c-bd20-af4023e668ae", "comment": "Malware payload", "value": "49a36c43664cd7b40e369f360ad476143752665eca0bd29bf4f1f65b57bea982", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356964, "uuid": "36b2dbf7-0ac7-426f-9a52-e74d98dc0b5e", "comment": "Malware payload", "value": "9caa61563e073ea812635fd562703b4b041e298a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356964, "uuid": "fdb7430a-a2c6-43a0-9a17-350b32a9d9f5", "comment": "Malware payload", "value": "b0f6f719f25715c0e100c57e65b440942b3c3e8235fb22a7dc4d968743a6f1c724dd50231f79fe33fb6079616ed88a50", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644356964, "uuid": "cec2bee5-9e4c-49b3-86c4-f15659a38e05", "value": "T15FC35A55F685EA1ADA0823350DDFC7F9333ABC828E9683473299B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644356964, "uuid": "6d27eda1-15ce-44c7-8b0b-4752b1d6005b", "value": "3072:AFcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBj:ecKoSsxzNDZLDZjlbR868O8KlVH37keL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644356964, "uuid": "4eabb4df-7205-4089-973d-a2bee4df3393", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644356964, "uuid": "79261ce0-7596-47e8-ae0a-fe6b08b712dc", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644356964, "uuid": "d87a6657-cee2-412e-8837-8e811124bf02", "value": "tmpfrfso1kx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0ab708-8910-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644346493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346493, "uuid": "1ec94f12-3451-41c3-8c95-f9bfd315a367", "comment": "Malware payload (Heodo)", "value": "b2734709ca85741a45b92087969ab7b7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346493, "uuid": "777860a3-7dba-4f27-b7b8-e52910ba3e64", "comment": "Malware payload (Heodo)", "value": "49dfd9b89f14cf3d8ebf273449514f1156558604ad98f35ed7bd007034dc3c12", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346493, "uuid": "e58d2a3c-e497-4838-9bb1-9ddbb62b1e87", "comment": "Malware payload (Heodo)", "value": "963115af206f72040f76d1f8482817ade1d4bbde", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644346493, "uuid": "5180300b-87bd-493e-8bbb-039dd7fe84ad", "comment": "Malware payload (Heodo)", "value": "c5644c4018df25d2609725d1733d3290cf404a1576211f9aea3f14360d3c9c29bfe609587936e2b5b15ea7b99ca62dbe", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644346493, "uuid": "da28e148-f7f9-478e-a1c1-2f19b4c01f77", "value": "T1A4C35A55F685EA1ADE0813350DDFC7F9733ABC828E9683473289B32F7D76550CA12606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644346493, "uuid": "0dfca4b2-d893-4ecb-ad45-500d688667e0", "value": "3072:WNcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBf:ocKoSsxzNDZLDZjlbR868O8KlVH37ker", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644346493, "uuid": "9706fdff-d6cb-4722-bf30-3792fb155a84", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644346493, "uuid": "17b68ab7-4979-4125-8315-7a6f704a003e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644346493, "uuid": "31de640f-18ac-4ef3-9998-764838a60741", "value": "tmptbnvsgf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d7d0cff-8912-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644347170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347170, "uuid": "3731d343-d961-4ccb-912d-1786bdd9c29e", "comment": "Malware payload (Heodo)", "value": "5a0dac0cf1190d1cb841fea448c86d3d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347170, "uuid": "4866fef2-6c33-4d3a-a182-98ffb451f05e", "comment": "Malware payload (Heodo)", "value": "4a3d0a417a524261cb4339bb43c12beccd70816afc7094928bca5f60db4fb2f7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347170, "uuid": "488570db-b69d-46c7-ad6a-6f0b3f5ce993", "comment": "Malware payload (Heodo)", "value": "b875dbaf79bfd3527286745096b7bc3893c0a688", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347170, "uuid": "6e9ad774-0563-4d02-a33a-b8d864fa5e81", "comment": "Malware payload (Heodo)", "value": "224607f34ec84fc0faeb39c5bf6091a5fe0e8ed15c73f03248e2bb865343509380a33a460255ccd3293293e5aaf626c3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347170, "uuid": "9c1d70cc-9a17-478e-9326-42d6e4375d54", "value": "T1CC748C41E952C03CFEFB00B9D0D6C62AAD1E2E211B9D569F6244366D36603CF163F62E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347170, "uuid": "7d6e278c-ad22-402b-9ce2-fd36cb3cb15b", "value": "79fb40281049052b3e354a6e444da473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347170, "uuid": "e6f42b11-b2f7-4f12-bbcc-c96935a150d1", "value": "6144:YFF10hIGpv9eY+wBuBqtrgummwYT4ahREWkOieUR6:yKIG5eEnmGcKS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644347170, "uuid": "4409e90b-a24f-4edb-b781-7ae39355b289", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644347170, "uuid": "413d3942-8816-49e4-a33f-b19a5998940d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347170, "uuid": "10559d85-6815-4c58-9d8d-950366608ae0", "value": "emotet_exe_e5_4a3d0a417a524261cb4339bb43c12beccd70816afc7094928bca5f60db4fb2f7_2022-02-08__190558.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d9646e0-88bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644310314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310314, "uuid": "b99d3087-3661-44ca-979a-eaf0932ffbb1", "comment": "Malware payload (Heodo)", "value": "f866b74ecffe522163e96a784e6ddcf0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310314, "uuid": "2901cef6-15fd-47f9-8712-cdddc35a0e23", "comment": "Malware payload (Heodo)", "value": "4a6f18a12f82aad0207aba1a95d26491be7e263d4ce8ef54c7deb91d8f1162fe", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310314, "uuid": "306a4619-d72c-4dcb-b4a5-55db7c23afbe", "comment": "Malware payload (Heodo)", "value": "601847efca3bd140914953080f08612994efed23", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310314, "uuid": "fe3448de-a6fd-4357-86cc-c532148363c2", "comment": "Malware payload (Heodo)", "value": "8348d0b6f7f9b6668c1323142eb5771329017004ca8bba432bb37c1f3f0391de7f2b811eb2eddd1257c35ab93e0c8959", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310314, "uuid": "c8da73fe-b6d7-46d5-9d75-4bd82ee25172", "value": "T14993499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310314, "uuid": "c14ba211-f2ee-4dde-8526-4963cc477797", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644310314, "uuid": "6cb150d1-fd8a-4808-a9b9-d414a0c3a1f1", "value": 97107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644310314, "uuid": "819795f6-cef1-4945-81f0-1a0ebd0d9eed", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310314, "uuid": "5584ebaf-1125-4326-836c-c44188fa705a", "value": "tmpz4lgxnq_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e60ab8f5-891f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644353063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644353063, "uuid": "8fb5fc77-002f-45f0-b2c1-76e51e43f1e5", "comment": "Malware payload (Heodo)", "value": "a1450b145e9f5d732aea7377b5a2ff7d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644353063, "uuid": "4984db3e-1ec7-43b8-a2b7-7cbe3d948bb6", "comment": "Malware payload (Heodo)", "value": "4ab77ca681732c7f4c8aff3f25bb61cb64b07bf2720cebb584f10992a0d8c2ef", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644353063, "uuid": "99b08516-d86a-4370-9354-dde9c168d121", "comment": "Malware payload (Heodo)", "value": "682d531f57d51b9650b2a0a670aa6fa7c7b70ec2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644353063, "uuid": "7b7e77b0-2259-42aa-bc43-a78a324da8ca", "comment": "Malware payload (Heodo)", "value": "d947fc12d8c34248f1adee746462bf8075712dbcca151932619093e2bf613763d9c057f818f1b52a354ab148f8778104", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644353063, "uuid": "35a21dd0-cb5a-4cbf-b51f-c6f9721d36de", "value": "T105C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473249B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644353063, "uuid": "1066b845-66ec-46b8-8847-7366282dbc34", "value": "3072:hccKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgiB3:ecKoSsxzNDZLDZjlbR868O8KlVH37keW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644353063, "uuid": "2430416c-b41f-412e-b36d-83372e4d1f37", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644353063, "uuid": "c44c7841-5029-4b94-aae4-a22afdf70bce", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644353063, "uuid": "5bb78c4a-c95a-42b3-819b-641a1ce18ef2", "value": "tmpwa_g637_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee987bae-887b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644282640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282640, "uuid": "36eb509e-0dfd-4b47-b9e0-1e874fe56588", "comment": "Malware payload (Heodo)", "value": "53aff36021a576c0c65fac17ae706e03", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282640, "uuid": "3f4587d2-8468-4db1-83c6-11173fdf5211", "comment": "Malware payload (Heodo)", "value": "4b1de94a44f82653c386bb6f2057e82b68ed41e8dc3d0c68b756e8fd8879582c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282640, "uuid": "14ad5bef-9176-458f-87db-af0aa18fa741", "comment": "Malware payload (Heodo)", "value": "46922e8449c07d8b4eb4150c4182f7013bd7907d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644282640, "uuid": "d090c9d8-e89d-427b-96f4-2b0d376cedc1", "comment": "Malware payload (Heodo)", "value": "1699d64184c5163cab2844b31ac99f05049371ac96600b8d2c7f58f7942d5d3be4e2f509a64fe0af22a4d7858fe6f200", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282640, "uuid": "6a2198e4-be1a-4ba7-8478-b5de9e82af04", "value": "T1FB93E16E6E2C2D1BE5EBF2399F3CDA6082241DD06391B4B960A17F79413C453C16AF6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282640, "uuid": "23f27036-5d0c-4014-a32b-00bf8a10a6a2", "value": "1536:zZRiRVqr8ZJXtx2SKa3Xm1WBXz7yL64i+kkfa+3gtfvjHtoxzg5bjIFDGx:zvAVqiJXma3Xm4nC5X5gxvhoxzMINGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644282640, "uuid": "8406af4f-9b2a-4962-bf00-1779460c6b30", "value": 94236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644282640, "uuid": "3908d853-53ce-4bd8-a04f-9e845b14829e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644282640, "uuid": "83929a7b-d2a9-4242-aa24-3ff2a2d968d3", "value": "tmp5g4m9wcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b423ad-88f4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644334613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334613, "uuid": "76accf0c-7804-4e83-945c-28540155d385", "comment": "Malware payload (Heodo)", "value": "87b94417fd8889bfa86b5af565a26e49", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334613, "uuid": "348b5945-e57b-4192-9e15-5612875f29f4", "comment": "Malware payload (Heodo)", "value": "4b69253d4f7ac32252c75630260dab5795f9f6ace36143524355eb58149a7319", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334613, "uuid": "efdb7e40-5080-4a1f-903a-953b519465a2", "comment": "Malware payload (Heodo)", "value": "d3aa1fe30b3bf6aaf6cc6d52f6a285906b877126", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644334613, "uuid": "cd5b8c45-d2fb-4f7f-aeb7-2cfcd8bdd6b7", "comment": "Malware payload (Heodo)", "value": "b1f5b563825915cea929df9e25ae6b12422ee5b3a5ad8c11cb2f5c411e0d797fa4bfba7bf29130cb13c39184212a6803", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334613, "uuid": "b4c0606d-19bd-4e8f-8be9-5249625b981d", "value": "T16ED38D6AB648CE0BD94913314EE7CBFA7336BC819F5297477295B72E1C3A580C603B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334613, "uuid": "92ff885f-f7fc-496e-bc24-4fc1755317f0", "value": "3072:IcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dg6a38:IcKoSsxzNDZLDZjlbR868O8KlVH3skew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644334613, "uuid": "54449175-3026-4831-a745-d24f93d7c80b", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644334613, "uuid": "1836877d-1d11-4cac-8b2a-b3269b326128", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644334613, "uuid": "bd195ac7-ca93-4e06-a5c2-ebb79641c305", "value": "OPAST GROUP_4.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0dd467-8912-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644347171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347171, "uuid": "2e6945d0-d38e-4042-a81d-adf1724447ad", "comment": "Malware payload (Heodo)", "value": "0f8471dc9494ae9e37c78c4367a054af", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347171, "uuid": "e738b5de-6a79-4690-8e32-65720579610f", "comment": "Malware payload (Heodo)", "value": "4b7444bd09417b38aa11ae6ff3124cf260c857049f1c95c6d6a5ae0bf311531a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347171, "uuid": "37b94853-f12a-46c1-9af8-c647dba332c9", "comment": "Malware payload (Heodo)", "value": "57440400030ff7e843f1c17258baed0244f8ecfb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347171, "uuid": "b89df27f-690a-4a03-ba98-74e65c62d5f8", "comment": "Malware payload (Heodo)", "value": "25585562f7def58b3ff42dd8bc912128dafa4a6dfaddc2bb104438fef5b740ef3b1a2bb30b3b7e121af11388e37eb508", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347171, "uuid": "8f40b29d-3b88-4d36-9277-54dcf876ce0c", "value": "T143748C41E952C03CFEFB00B9D0D6C62AAD1E2E211B9D569F6244366C36603CF163F62E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347171, "uuid": "85c65cc3-3718-44bd-bf6c-c1a5b49b8687", "value": "79fb40281049052b3e354a6e444da473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347171, "uuid": "49709f49-8837-4187-93c9-8c22344ce4f6", "value": "6144:YFF10hIGpvWeY+wBuBqtrgummwYT4ahREWkOieUR6:yKIG5rEnmGcKS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644347171, "uuid": "2e8a3e63-9a09-41d4-9988-113383eb6d66", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644347171, "uuid": "38a8ef58-4f5b-4f16-80e1-b616c57dbb3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347171, "uuid": "1df558eb-da80-411e-9cde-252a3e15dec3", "value": "emotet_exe_e5_4b7444bd09417b38aa11ae6ff3124cf260c857049f1c95c6d6a5ae0bf311531a_2022-02-08__190558.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2b9ec1-8881-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644285050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285050, "uuid": "48266511-e605-4497-9612-113972fd8207", "comment": "Malware payload (Heodo)", "value": "bcb71f8dd88df76b865f33de7494bb16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285050, "uuid": "ad4acf2e-9116-49f1-8abf-1e64e7017628", "comment": "Malware payload (Heodo)", "value": "4b7f7561aced40fe16838723b72ca6bd5e34256724f95344eaaee98823342d09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285050, "uuid": "8307f997-ac2a-48ed-b8b1-35e02767e943", "comment": "Malware payload (Heodo)", "value": "01b788c49477d1a19c42cd05b42a0ddf67597b40", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644285050, "uuid": "6fe59ade-9882-4006-8440-b2a7c4aac8da", "comment": "Malware payload (Heodo)", "value": "c0a5e2c6ea0203139eda9a29653919441a3e7ca99d51a843695349e7d28b1be28a9f8fdb603568497a824394e3550156", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285050, "uuid": "277cb271-2586-4bbd-b309-a97216a6aa66", "value": "T1C0D429AB3A8FA1BDF17B017A6350FB44E4D27C1A9FBD25D70A86358893F2D054F18A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285050, "uuid": "b1c9c032-4e6d-42d9-8c61-dbe2bfb62b95", "value": "bf1ebe22ec6f51f906ec295a3a5c6d92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285050, "uuid": "eec627c9-9015-4543-8f1d-1c3855633008", "value": "6144:x42k6LwFPw91EDbkUE39P7pyADYzqlEDFmZ4s3wAD9cvIpxUIVZFoEXlbeZhp4ga:x409qDb109PdyOYzq3D3fVbeFTi40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644285050, "uuid": "137e1c18-8622-4521-94ba-2ef16df29859", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644285050, "uuid": "a3589a78-8c70-4928-974a-c6cdf8b77562", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644285050, "uuid": "25b1498f-0983-4fb1-97ee-73ac37fe282e", "value": "bcb71f8dd88df76b865f33de7494bb16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038ac5dd-8903-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644340657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340657, "uuid": "6bf17759-ef31-41b4-a27a-f508a6aa4d26", "comment": "Malware payload (Heodo)", "value": "c8e4b6775fae4e7a2604676b16664992", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340657, "uuid": "0a26f68d-d854-4b81-9c7d-897b479a0b9e", "comment": "Malware payload (Heodo)", "value": "4b98202753cd1b422738528f0d1ad2e7591df4aa529711e25a3ceedd2aa170db", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340657, "uuid": "ba05c572-99a0-4b1a-b550-b4182a450c91", "comment": "Malware payload (Heodo)", "value": "d4cb05d84653441ca6b6c6528dfbd7dd58e07f85", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340657, "uuid": "9a73c77f-5d0f-4134-80f2-4b3674747850", "comment": "Malware payload (Heodo)", "value": "6befab9a9614298c71889c0ef10f0ad862b5cedd70d1899efb39f7ff3c84481fe5761b62dbedaa380a6c4b1d3b293190", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340657, "uuid": "c7c146aa-2e2e-494a-91ce-219320973c84", "value": "T1B7C35A55F685EA1ADE0822350DDFC7F93336BC828E9A83473299B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340657, "uuid": "f4d67c45-547a-422d-8a8d-68f8a17f0e5b", "value": "3072:UqcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBJ:NcKoSsxzNDZLDZjlbR868O8KlVH37keN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644340657, "uuid": "fb4928f1-130f-4557-874b-01cac75723bb", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644340657, "uuid": "5a47c465-e0b5-44e0-828a-a2660ba92539", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340657, "uuid": "135f8f89-336c-4671-a667-ca6ba7093834", "value": "tmpb83nvh2t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7239fbf8-889d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644297034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297034, "uuid": "4fe73ea6-5ecc-4a59-b193-de382b39a539", "comment": "Malware payload (Heodo)", "value": "bee4d2289a7c7d51aff917e20ab487a6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297034, "uuid": "3391fcb7-3857-408d-8a82-fbb805639ed2", "comment": "Malware payload (Heodo)", "value": "4bb6740c9152450dc827cbbdf802be3aaa5c0fd016ca663795f145f6bad36a4c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297034, "uuid": "006818e7-a911-48a1-85eb-474821fe5c49", "comment": "Malware payload (Heodo)", "value": "6a16b069094b48086324ecb755614f858d58fbf5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644297034, "uuid": "21a927e5-14a9-4f32-8f97-f8bc659af020", "comment": "Malware payload (Heodo)", "value": "b2794c97593b55c7d20c3f90eaf9031263819f94718fd48f7da6c18e6dea52a5e7348991c3d806375272861eed18038f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297034, "uuid": "9d6f281a-c228-4169-9441-0d6c36796a3c", "value": "T15ED38D6ABA48CA0BD94913314EE7CBF67336BC819F5297473295B72F1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297034, "uuid": "1ed5af6f-2173-446c-b479-32e2ade3be5e", "value": "3072:ycKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3M:ycKoSsxzNDZLDZjlbR868O8KlVH3skeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644297034, "uuid": "3ffbe1d1-80c4-4a9f-84c8-d6943a1e6f37", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644297034, "uuid": "2de7a858-c66f-496d-a7dd-b9f60df4f1d3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644297034, "uuid": "9072832c-a38a-42f0-bb6a-8fc7770af2b0", "value": "tmpn7o4g5wk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c5d7e5-8901-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644340039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340039, "uuid": "b40b4a15-5cbd-462f-ae4a-1f152c02e12c", "comment": "Malware payload (SnakeKeylogger)", "value": "c23ce4292b1f9362d12198167849bb80", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340039, "uuid": "f75fcb77-afc5-4bbd-b079-abd1af773c88", "comment": "Malware payload (SnakeKeylogger)", "value": "4bb6d08dad879c7e0098024d645c92c198484e1d7703019fa0db7ead6f867bfd", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340039, "uuid": "7221dd00-baf7-4913-962b-6c8bad2c4e1c", "comment": "Malware payload (SnakeKeylogger)", "value": "78665b05a2b48809edd743b658cf25d731d5f5e6", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644340039, "uuid": "2b03c082-e83b-473f-a9ef-e8411a09ce40", "comment": "Malware payload (SnakeKeylogger)", "value": "0cfa16b2ca49cd65dfa707c14a636e13fc9de0a4b01634cc62bde797de0c3d122496f7422a55d6b254fbe4fa48e0ebd0", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340039, "uuid": "a7c7f4a6-6f51-4140-88f1-1422435f4f36", "value": "T18CA31295366F657FE28F8D3D8406330FEBA105469D466CA60EADB14F785C8E30312E9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340039, "uuid": "696c2e9d-ffd1-4a7f-b1ce-4223baf54a9c", "value": "3072:y5OKZu86S3Roy9uFwZlsaFPOHYonHBxqPZ5l/:y8YuS/IwZltFPgYonHBxqPZv/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644340039, "uuid": "72f43663-4e3e-42a4-bc04-56b2bf48880c", "value": 104604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644340039, "uuid": "0dae4b37-a95a-4f1d-84d4-60904df8c77e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644340039, "uuid": "82334e2a-7f0b-45f4-ab62-bbd9b04b65fc", "value": "58506013077.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122a8953-88c3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644313194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644313194, "uuid": "518b96b3-79d0-4a57-a090-228c1a44ec4d", "comment": "Malware payload (Heodo)", "value": "7965bd44d863662c0214a7e2f936327f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644313194, "uuid": "eb209014-ae8c-48f8-8bb9-16c357066fd0", "comment": "Malware payload (Heodo)", "value": "4c428dc5865f9ea8f59fd34db8d3123ab96aec72f7edd54af1e3bc958d9cb27c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644313194, "uuid": "9209c554-8c25-42fe-b234-271ec63bcc5c", "comment": "Malware payload (Heodo)", "value": "b87be60fbf48ef76b2c4dce1f981b626b037b36f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644313194, "uuid": "9f78d147-5124-4f3e-8766-abb6929f440c", "comment": "Malware payload (Heodo)", "value": "f8aa6762788b0f209053113a621e731668608ca7fe12761206d7791a63ab58457f39c7bad716dac0533b7be6620cb887", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644313194, "uuid": "36978381-423f-46b4-b047-db536b6374b3", "value": "T19293499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644313194, "uuid": "dca9c445-6937-4d22-9ea8-58f746bf2f15", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644313194, "uuid": "e2bb1638-7c8c-4fc5-8ac4-2312537db845", "value": 96490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644313194, "uuid": "c25fa923-8b88-417a-a66c-b69649e81f5a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644313194, "uuid": "c3881da5-7055-4e6e-b434-cb14a66526f1", "value": "tmpqc01siou", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007b15ed-88ca-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644316171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644316171, "uuid": "747aa842-f64d-49f0-b017-e98114382444", "comment": "Malware payload (Heodo)", "value": "bf955606c14dc9494d310a18e27b5969", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644316171, "uuid": "bc3374ec-1692-4fad-96fc-bbac52fb648d", "comment": "Malware payload (Heodo)", "value": "4c7008e7a9a5d914a9fb7ffc365f55e9aa219eb4f8439be5fc8a30812d361aa8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644316171, "uuid": "f602221e-0797-4c14-b471-bb32ce5928b6", "comment": "Malware payload (Heodo)", "value": "395ef5e50f105d45e3558aa831094fb4ca23921f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644316171, "uuid": "d6124320-285e-4915-9341-706ee689a687", "comment": "Malware payload (Heodo)", "value": "a75f530a0e38f6534c49e8fa133645f0e9f3f316f4880cf3d3fd2c3be0bb86e509e3165292e171df22ba32a12e774dcc", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644316171, "uuid": "1d79ea2b-9ed4-4c7e-a94f-f7a85877ad64", "value": "T11E93499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644316171, "uuid": "83cb1511-99db-42e3-b6f7-41b1ce1222dd", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644316171, "uuid": "6d9ccd5b-6fd5-42c2-968b-74cc466b4e35", "value": 96883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644316171, "uuid": "8773984a-d9a9-483e-900b-7781fd36ecd7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644316171, "uuid": "100bc7c7-0b12-4194-92d5-23a8acfcc1f5", "value": "tmp15suyocu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb2602b-891b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644351281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351281, "uuid": "89c20ea9-0480-4953-9442-0e597f5918ff", "comment": "Malware payload (Heodo)", "value": "43513ce1b19b041b7292049903a01901", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351281, "uuid": "24190985-11b3-4dae-b533-8b49e6beeaf6", "comment": "Malware payload (Heodo)", "value": "4c7d0cb1aca07e84e42fe85151eb294b50f81122e490cce6d37de53560c0599a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351281, "uuid": "b9092411-9621-4a6d-9ae6-a22e38a5a215", "comment": "Malware payload (Heodo)", "value": "b755c38065aa057b8caca106affba325e47a4d5e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644351281, "uuid": "9f8de309-d2df-4282-ba72-1bed296363bc", "comment": "Malware payload (Heodo)", "value": "64f19e09f78dec0116076fa40a2bdbf7869c6dea763fe9a8b163a5d55d26e468e503fd064c176b3a5753ddea94b7fa5d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644351281, "uuid": "37a98800-995a-4a85-9e6b-82afc287aa77", "value": "T1A1C35A55F685EA1ADE0822350DDFC7F9333ABC828E9683473299B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644351281, "uuid": "bd346e13-d479-4f30-929d-78f67f6ab71f", "value": "3072:AZcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBR:mcKoSsxzNDZLDZjlbR868O8KlVH37ke5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644351281, "uuid": "52886a72-1be9-4304-aef6-7f06114c6727", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644351281, "uuid": "0b3d8c6b-9766-4372-bc46-829c7faac122", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644351281, "uuid": "501476d7-dfa4-4613-9bb8-ef81ba003ffa", "value": "tmp6tk4w0ag", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d6ba2b5-887f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644284061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284061, "uuid": "ec9bb68a-a918-4c85-9a3e-58eb1b4c6ca3", "comment": "Malware payload (RedLineStealer)", "value": "8550ebb8f4f5b377df3a3492dbc08f63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284061, "uuid": "bad91fbc-aec1-466c-a97f-0d1333bbc6e7", "comment": "Malware payload (RedLineStealer)", "value": "4ce378a5ea71af10bfcbcc5b39dadbeb86718437cc92566a77641222ab2bd44e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284061, "uuid": "1330d7d7-c109-4734-a403-9c3ba2eb4351", "comment": "Malware payload (RedLineStealer)", "value": "b28aa83aa21501a8d12bba80d964da54adcb4162", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284061, "uuid": "04acfc70-69a9-44ac-a60c-6273171e1182", "comment": "Malware payload (RedLineStealer)", "value": "d088cf65126050811b5622bb24d931c8f5e27a6e3711dbba11893985c8ae814b2b81a9df260b62dfa9b5969488feda38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284061, "uuid": "05dfcd48-9c06-46f2-b02c-d1ecbfcf844c", "value": "T13DE42341CF9428B4C9691A3022D1DBB07F60ED1A1A184F6335DACD7BBEAE2D73F91550", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284061, "uuid": "ce3f5be7-0e1e-4e3a-b369-15f2ad7a12f9", "value": "fc2363fa7dacdefb848d98e86cffa509", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284061, "uuid": "b1b0e92e-16bc-4f56-a5a3-d153379cd042", "value": "12288:sczUP4HFvUYkvwTfp5c2Oe6Pd0ukLGaHHA8V:BzxHeYmK96ZkSkAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644284061, "uuid": "cd0b8825-ec27-4b5a-b111-19b1c6605a3b", "value": 668880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644284061, "uuid": "d0928ef5-5b00-431c-b6a8-88cf43cd1f0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284061, "uuid": "579844d8-3d66-458d-adca-48dab102d17d", "value": "8550ebb8f4f5b377df3a3492dbc08f63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6635327-8884-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644286492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644286492, "uuid": "8a8d7930-48f3-4920-848b-ccfc1a55e64a", "comment": "Malware payload (Heodo)", "value": "469a1f7d39d3c0118e65584007727c43", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644286492, "uuid": "7c2ec027-08d0-418f-90e7-bb5175b481bf", "comment": "Malware payload (Heodo)", "value": "4d1a3447690d1a6d31196bd38664ee7640c9340757e604c42db84017c098d9de", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644286492, "uuid": "ddf5a786-cea7-4da8-90d0-cab9dcd5698b", "comment": "Malware payload (Heodo)", "value": "37e61820b5bab9e5ac03cba9f4a751eabc122178", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644286492, "uuid": "48bdace7-4738-4256-b176-eff7ce38c045", "comment": "Malware payload (Heodo)", "value": "e85e020d79f3c67055c4f210bb52cfa19f0780fdd9a47c6231b59b945d0ec6b02fa0ba9239e9bf3b31d0c22aa83916b9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644286492, "uuid": "487dac76-308d-4fc0-b5d9-48ec45b07a1f", "value": "T1A093E16D3E5C3D07E5DBE238DF38C66092605DD036A2F97A61A17FA9023D483C166E2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644286492, "uuid": "4a4fbafc-8d3f-43c7-8c91-f87571439ee2", "value": "1536:zZRoqIoLI6uXUdFGKQBz3sSSKa3Xm1WBXz7yL64i+kkfa+3gtfvjHtoxzg5bjIFp:zvoqZLDuUryBha3Xm4nC5X5gxvhoxzMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644286492, "uuid": "188aceb4-3434-42ef-8146-ffbfbe2d152c", "value": 94225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644286492, "uuid": "ef58d027-ab94-425f-af7e-75c40beeea10", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644286492, "uuid": "e5944235-9703-4713-8f27-30d99bd2d1d3", "value": "tmprc25uc_p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4449055-8880-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644284690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284690, "uuid": "d7ccc04c-6490-4128-860a-615e1cd2b132", "comment": "Malware payload (Formbook)", "value": "30a5be45faf97c1a7eeddf81c369fc4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284690, "uuid": "e03cf36c-2722-476b-8a3e-ccd43d520e6f", "comment": "Malware payload (Formbook)", "value": "4d1ac5962b58c0bf6386b85fc1c2029efb0c8d5ccf0054733795eec1ea8b3291", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284690, "uuid": "7a99dd4c-502f-4005-b320-a6bf7e09f064", "comment": "Malware payload (Formbook)", "value": "84645956d3168cd83d40f18901170480c813a12c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284690, "uuid": "54c6f8eb-e826-43da-8049-356c47645f35", "comment": "Malware payload (Formbook)", "value": "2c451b7b53033c55c70e2318e89cbd57f812ad2363f6d3c981a9a48ca64b7f2c92a4b0d5539df9f24cccef4e242c2627", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284690, "uuid": "29a9be76-161e-49ec-8f2d-fbaf55fc2ec8", "value": "T10294D391204AB769D6150B71BB96D01E4F7B59BAA9C6C10F36D47EFAB7AC00CD30312B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284690, "uuid": "0ade1562-21bf-4d2c-84a2-28e2c8000db4", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284690, "uuid": "fa6f3579-61cb-4356-ade3-3ffaaf184e4a", "value": "6144:nw82uaAJScHj0N86PENsFJ+y/W97ePrfbuXrGFHvQl0B8tkgb3x+:28YIyg7ePrfbQUPM0B8tZb3x+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644284690, "uuid": "0db80536-1aea-4d8e-aac2-b8cee2cc1d9c", "value": 419343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644284690, "uuid": "88359310-81f0-404c-a790-9b8832a5a216", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284690, "uuid": "c9402892-1063-4ab1-8ff0-204b835458c4", "value": "30a5be45faf97c1a7eeddf81c369fc4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f8a9ef-8872-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644278457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644278457, "uuid": "dc8122e0-21df-438b-beed-be7b239e522c", "comment": "Malware payload (Heodo)", "value": "929d7aa933704d5d399d163cb78fb819", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644278457, "uuid": "772cefe6-0bc9-4c0f-8853-d215115b436d", "comment": "Malware payload (Heodo)", "value": "4d3b5fe29131a12b1fe214fff23b247de8e1096ee9ce77b9f95888a89ac2c682", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644278457, "uuid": "aa956f8a-cacf-4ad2-8d72-cc64e2104806", "comment": "Malware payload (Heodo)", "value": "8f70523ee6f1fb4e9a320557a39c3b1e8c3e97e2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644278457, "uuid": "c8993aa3-ecf2-4929-9cd4-f9236fe42768", "comment": "Malware payload (Heodo)", "value": "28e5bd7c6fe58e62f5f77675fbda68c46aef852075b3af6c7a402051c8bb5bcb40082076f30196c6c474af11c075cf91", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644278457, "uuid": "9a04e924-1e55-48bb-b4f1-1b7705733cfd", "value": "T187D429AB3A8FA17DF17B017A6350FB05E0D27C1A9FBD29D70A8A758853F2D054F18A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644278457, "uuid": "383a7c70-8b1b-42df-a4bf-ca8fc3a09eb5", "value": "bf1ebe22ec6f51f906ec295a3a5c6d92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644278457, "uuid": "fe8a7957-cee5-45ac-b9c0-a1dda82ac7a6", "value": "12288:l4WjRiEKWKhqyuYzqtNDH2AyKK6cl788IO/:9KWKh/ZqtV2AJuQBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644278457, "uuid": "0ebc3ba4-b3b9-42ef-bdae-39dab3a9c4d4", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644278457, "uuid": "99bd1885-fc85-452a-97b1-6afac10bb6ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644278457, "uuid": "eca62ff1-8f15-4efa-8075-16d6624af844", "value": "emotet_exe_e5_4d3b5fe29131a12b1fe214fff23b247de8e1096ee9ce77b9f95888a89ac2c682_2022-02-08__000051.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87772df9-88dd-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644324558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644324558, "uuid": "0f220801-4105-4831-99a4-69e30530d716", "comment": "Malware payload (AgentTesla)", "value": "bf04d20c895b79fa0176c76c1c3dad63", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644324558, "uuid": "ef85f658-5693-49de-a9bb-79e5385bf2bb", "comment": "Malware payload (AgentTesla)", "value": "4d573a4dda854fe815db6408940365633a33bbfb727c3e70b333ce6be3dbd6a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644324558, "uuid": "f3f599f7-baf4-4597-a13d-b1f7e2826138", "comment": "Malware payload (AgentTesla)", "value": "3da445eeddaea059ec5ec753036dc290f5f20d05", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644324558, "uuid": "4d3d8803-0bea-4f0e-afa3-b8996fc54fea", "comment": "Malware payload (AgentTesla)", "value": "85d27afac0da7963434172ea91dda41121c7645a1ae586e4d3a214d0ef75aa56b5023b0275198e399c986b389beabadb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644324558, "uuid": "cf332526-83eb-41d2-a867-a06863e9bf4a", "value": "T158C48B3F49BE113AC6BCCB7188D0CE1FB426D5563973A91D2A9626D905232F275C223F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644324558, "uuid": "bc2def9f-986f-48c7-bd23-92918152a94e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644324558, "uuid": "f1941e35-8a4d-47fb-b74d-e0a61e8bc30a", "value": "12288:yROsMRUkUYa4dgmkDmmY/9fmtUSTvWrXpUU36SYkC:yRQUkUYaWgmmmm09utbqpUXXkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644324558, "uuid": "81fdcfae-6242-4088-bc6e-1c4628c27125", "value": 575488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644324558, "uuid": "f4eb37ff-3dbc-4e64-8483-7cf5f9cb6a51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644324558, "uuid": "1d27cc7a-9d73-40f1-9e16-b3a14c829e81", "value": "NEW POs _ 234, 233, 232, 231 and 230 for Feb 2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60e89056-88dd-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644324493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644324493, "uuid": "3ffc34d5-d9e7-422c-b72f-5db65cd70967", "comment": "Malware payload (Formbook)", "value": "08b80fc048531e352da2ff1ffd890506", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644324493, "uuid": "4d48198b-64c6-4e48-86f0-653107a127f0", "comment": "Malware payload (Formbook)", "value": "4d67b72f0172aa0aea973269146344863ba0f662a7a06eb399d0dfbbeccd66f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644324493, "uuid": "2ca61c45-0a16-4e54-8664-4b268ab911d8", "comment": "Malware payload (Formbook)", "value": "46f179d1be59306571066f1e2430463e8f868fc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644324493, "uuid": "7d46a898-8588-47c8-9eb3-b7b62c96e100", "comment": "Malware payload (Formbook)", "value": "d7826bcde2f5486bd967a54d2b3a178f2a2f2314c9b17e7cfc6d1f8f3777724e0e33333e6a343cda44feb66c0baa2dac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644324493, "uuid": "d30b5a72-586e-4d0d-9a47-b816b6a3db55", "value": "T180C4CF92F08489DAEC6A13B2983BCC251163BD7DA9F0A91E569FB62557B33D30017D0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644324493, "uuid": "be43e8b8-812f-42ad-a059-7012ef8b09cb", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644324493, "uuid": "3bbe3bcd-cab9-4673-ae92-24b192596613", "value": "12288:iLXSgSIxkdCefqSrU2rOQ5Avgt38eGJhYZ:ixrxkdCefscOcNt38la", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644324493, "uuid": "402f37e3-4bbc-4be2-893f-a069572c6217", "value": 581039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644324493, "uuid": "3062d1c5-d930-4f95-9059-e17bef0cc676", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644324493, "uuid": "897a0249-9104-4359-adf1-c044d27a1778", "value": "HSBC_CUS.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d70ea2-892d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644358781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358781, "uuid": "19b2991a-339e-471c-b34d-94d41582993c", "comment": "Malware payload", "value": "0a0744b0dff43c75f21e1901e659e010", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358781, "uuid": "04c0b35d-41f5-44c3-8b98-c8c0f09652b1", "comment": "Malware payload", "value": "4d726c9fa4f3209135f62d157c497f4c771b9bf8d11adb1a11d07358ea2f5874", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358781, "uuid": "81d0a140-48de-48cb-9018-5236e008ff00", "comment": "Malware payload", "value": "29b14b1a009b8a2e6814897c2d4cd05f3b8238b9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644358781, "uuid": "a52ea952-0446-4e37-8bf1-55819a752f9d", "comment": "Malware payload", "value": "14b6b469a6652e201c74ed8662077f70dff16ff0f8c6d112ec5d475bf9aa7b4c9783da2659d688a3efb55f6ad3d6d8c8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358781, "uuid": "7b23c54a-ea8b-4964-8b60-fb2bfdd3668a", "value": "T1FBC44B13E68398F1C79C803973AD7BFF802A155547E876D30BF1858869AC0E14BB7D9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358781, "uuid": "d7f4d6ed-c7d5-43bc-9fef-7bc2f098599a", "value": "1059dec3a72d4c311e39c8fc33d5af98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358781, "uuid": "b442b458-8c07-4c4b-b0e0-74c46597f8ef", "value": "6144:/mbbvqXJery1jH9OttfeRdq9r8BVBALMaX5c9e8h2qYJVwdFmFlE/S:QbvqX4+eKdq18mLRX4eg2jJ0F9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644358781, "uuid": "9357f680-9103-423d-a10a-ed0c43053435", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644358781, "uuid": "ddcbafca-1bc7-47b8-a7d5-eac0c407bf74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644358781, "uuid": "863de096-9f2c-4869-aa18-9a858b46d86c", "value": "emotet_exe_e5_4d726c9fa4f3209135f62d157c497f4c771b9bf8d11adb1a11d07358ea2f5874_2022-02-08__221927.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee78395c-88a4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644300249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644300249, "uuid": "d9b99315-3f03-4401-bb26-3455adaa30c9", "comment": "Malware payload (Heodo)", "value": "8992a30b2a9416341a3cbcb6450419a8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644300249, "uuid": "794a1d9e-12aa-4a0a-8d66-e47c2f04cada", "comment": "Malware payload (Heodo)", "value": "4d804ecb26489167a89a988e84621ee10f2cd1e72e18daab55c0f3c100fee6dc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644300249, "uuid": "c43b6fcc-8d23-45ee-8708-3020af4b1e1b", "comment": "Malware payload (Heodo)", "value": "cdd87ccdbfece60fbac83c995ab9f2d9a0781434", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644300249, "uuid": "23ae785e-8b14-43af-80b5-0c3be4d7de78", "comment": "Malware payload (Heodo)", "value": "6ec24a65e9efc741f0e3e58602422510e25cbaf89d5c7e50b687c7a7387dd4feead712505c58ee31061973984b13071b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644300249, "uuid": "80aeb66c-e8ab-44a9-8ea3-b77441379940", "value": "T1A2D38D6EBA48CA0BDA4913314EE7CBF67335BC819F5297473295B72E1C3A590CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644300249, "uuid": "63f28867-5f38-4749-8048-0aa97cc47497", "value": "3072:rcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3u:rcKoSsxzNDZLDZjlbR868O8KlVH3skej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644300249, "uuid": "f86c23fc-27af-4a4f-9c7e-e20c0e4852ab", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644300249, "uuid": "6cd6bb08-ac46-476f-982b-ba3840b94baa", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644300249, "uuid": "98aefe2f-f7de-4307-a6b3-43c636ad0bba", "value": "tmpqxwb3txp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c3ea4ca-88e2-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644326552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644326552, "uuid": "fbd4cd1a-d4aa-45ee-879f-5e8db11c41ed", "comment": "Malware payload (AgentTesla)", "value": "29ee1d9011336e3e66926f0e8b0ca50d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644326552, "uuid": "709968a2-b2c5-40c8-8339-d74af7d00485", "comment": "Malware payload (AgentTesla)", "value": "4d8cc854f05f35da6bc67aee17a77881ebbac13353220b1b09bd64dede93a884", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644326552, "uuid": "a5570a08-9e75-41c6-a6e7-0574b53f7795", "comment": "Malware payload (AgentTesla)", "value": "acb384a701ef61c312dc73aa32eb4407ba1afbb9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644326552, "uuid": "a73d4004-0cf6-4dc6-84e5-b53eae9683de", "comment": "Malware payload (AgentTesla)", "value": "e077497698422feb860d206bfd97d8ade180779ada68550172e97c142c6369c507f8a8783ef5a893ea0f8614f1451609", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644326552, "uuid": "55b3d32c-27da-464b-b790-89190804f1d1", "value": "T1EAC48B2F49BF113AC6FCCB7198D0CE1FB826D5863977691D2A8625D905232F275C222F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644326552, "uuid": "262f8a68-7aa8-4370-86c3-0608c3b1549b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644326552, "uuid": "0e404e4a-642d-4cca-90d0-eccdca0ca8f5", "value": "12288:dMHdmQRKuBK+4r9dP0+uaq0Mq0VwFkD+mFY+ZZuJX:dMuu74nc+TYq0rXeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644326552, "uuid": "58516703-c86a-48da-bbc6-9edeecedab0c", "value": 574976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644326552, "uuid": "a178289a-1b3f-450d-8e77-5ff00a67c0b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644326552, "uuid": "db2e36dc-a569-4be0-8380-53240688f932", "value": "STATEMENT OF ACCOUNT February 7, 2022..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9207acd-88ad-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644304079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644304079, "uuid": "e84b68ee-f0d4-4532-b3a6-1509b6fd460a", "comment": "Malware payload (Heodo)", "value": "a91e04374989278f74e947f52e30a4df", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644304079, "uuid": "1533795c-8c9e-4856-850c-47a6fbbae542", "comment": "Malware payload (Heodo)", "value": "4dcd48617edd2c9f2225f041bb6665c0a65ca611802572e3bf01ee1faf5f42f4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644304079, "uuid": "5c203750-9a62-47aa-87b0-6ddb70e56244", "comment": "Malware payload (Heodo)", "value": "8a7c8425d053627d9406d4dde9f904ac153a1365", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644304079, "uuid": "a5cf2209-4677-4ea9-bcc1-4f3e53249d8f", "comment": "Malware payload (Heodo)", "value": "b5239ae0bc9802f4e4889cc9e0cc9cb438753b2e2f861ea151f4fe2b907d653bb6266e2f475796e79d0eb182fdf5e96f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644304079, "uuid": "71bfd852-4263-4210-86ba-2c1181c5831d", "value": "T19293499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644304079, "uuid": "c596732e-37b6-4688-b6d8-292f26de3f97", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644304079, "uuid": "de2cd881-a033-4420-b10f-eb2d7dffd041", "value": 96744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644304079, "uuid": "d125b9f9-4d82-4b3d-a4d7-c973404480a3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644304079, "uuid": "c98cf3e6-a579-46ab-a15a-cabb2b553e84", "value": "tmpvx2be7t4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c91fbe-88e1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644326412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644326412, "uuid": "98546c92-b6da-475b-a3f2-d0041d54efd9", "comment": "Malware payload", "value": "fe4dd5d5c3a68509dfd8830cb86dae23", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644326412, "uuid": "d5628400-4947-441d-8bea-ef6ad9f4ba0e", "comment": "Malware payload", "value": "4dd8c8adb2ed29ead05e4aa464f0b8e82e4998d6b3a8250fde4255779c08f3dc", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644326412, "uuid": "718671e0-d6d7-45ed-ad48-79d61d88ad77", "comment": "Malware payload", "value": "728b1b72453d5d430f148973f2a3dc7cf1e5145b", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644326412, "uuid": "9c351216-d195-49c2-b8a2-50611fc91e66", "comment": "Malware payload", "value": "7e1713214acd0ec4dcca744a0b69efe579024da2ec26ebb2f35a1dfaaed97e82ac15cb4888f8220b40452ed9fa66bf7d", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644326412, "uuid": "5ee50f5d-96bb-448b-b9af-4b2f8e3201c8", "value": "T103D022F57E02C0C8F4AF33062E86F9E4688AFA50F48A960C70496469011035EC249B60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644326412, "uuid": "c3ad5564-3dff-4ec8-b410-eae0950ec844", "value": "6:G8D8gZrsxROM2+WHLXELq8Iwn/J2XKDPXbFn:G8DxtsXjWrYqLwn/JUKDvpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644326412, "uuid": "d5d385d1-8d1f-4f94-9115-6b2cfb55c4dc", "value": 212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644326412, "uuid": "32db43f1-55b9-4402-b4fe-fe7593af5154", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644326412, "uuid": "d7fe91ba-51e4-42c2-9134-ec25b160d77f", "value": "Informazione_09.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18bbbcd1-88c0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644311917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311917, "uuid": "10d85b5b-af08-4bcb-8f7c-d2221be8e1fb", "comment": "Malware payload (Heodo)", "value": "7fb5790eef876bccfd20d0d86eba1b66", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311917, "uuid": "b34782d5-e85c-448e-82e9-a02b514ead75", "comment": "Malware payload (Heodo)", "value": "4de6bc6e7bc610470a9d59f4e91564da91dfc73f7af3d47ef7d687f21cd48bf8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311917, "uuid": "f395dc93-2c05-4433-872e-4fd331d2174d", "comment": "Malware payload (Heodo)", "value": "cfce7a9d2ec1242ff8272ffc69d700161c14af02", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311917, "uuid": "9fa081fe-1177-499b-a2cb-f019f4f1936f", "comment": "Malware payload (Heodo)", "value": "06d4408f9ba4474e53c27b2095207ea391d3e6109bb355e0f2ac7a51f322e6de2047495e51a48280313704a692dbf40f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311917, "uuid": "da0f1527-db61-4285-9bb6-4b81a80c8e04", "value": "T10793499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311917, "uuid": "35c0c4f5-9e4a-4adb-868e-fd6b8cdf5944", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644311917, "uuid": "0e25527b-6294-41d2-abe8-6cb838f437c1", "value": 96763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644311917, "uuid": "f3bd2de4-39a9-4da2-a959-a41af5a1b824", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311917, "uuid": "8849acc6-52ce-42bd-804f-019ebf3f5350", "value": "tmprmbbjcxr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9666ed8-8897-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644294604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294604, "uuid": "f854f4e7-9835-402d-bfa2-d77240c5bb08", "comment": "Malware payload (Heodo)", "value": "344d4f0885f9b52d42275b99e1b812ee", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294604, "uuid": "a9cb7d2a-2f3c-4477-95a7-972a7798a197", "comment": "Malware payload (Heodo)", "value": "4dee85cded42b32cda9093f5545de2449039baf70f044d370f01c3699ec0309b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294604, "uuid": "8780de8b-80d8-451e-883e-dacc801af52d", "comment": "Malware payload (Heodo)", "value": "cbfae11c8ca9fc9fdf3f975ac020bdce98a6fe01", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644294604, "uuid": "d5945e55-bdd6-4a6e-8f5b-23fc6178cf19", "comment": "Malware payload (Heodo)", "value": "ff3252fd7914022151a23501daafa2ac73d3f86b8e0dec1edd5f638d2832e9afca375aaf20a26f6c320cf97655c6d69c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294604, "uuid": "23aa3df2-5329-4b7a-8949-4dd261d13f4d", "value": "T1B0D38D6ABA48CA0BD94913314EE7CBF67335BC819F5297473295B72F1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294604, "uuid": "2a88226a-4518-4aae-9727-8718c6485400", "value": "3072:QcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3W:QcKoSsxzNDZLDZjlbR868O8KlVH3skeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644294604, "uuid": "327768a3-dfc3-41ce-b657-989d1fbc9666", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644294604, "uuid": "3fbc6ca3-763d-492b-9300-096a025b453a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644294604, "uuid": "b783284c-0aa6-464d-9d1c-4d7b04c27e92", "value": "tmp3ue3af19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e05964-8891-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644291697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644291697, "uuid": "e2458d9d-785a-4893-9f5b-a53e7c84159f", "comment": "Malware payload (Heodo)", "value": "a24302e00b8fdbea88594d399ff32e59", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644291697, "uuid": "dec53e53-d954-462f-8faa-1b68fdf2ce8f", "comment": "Malware payload (Heodo)", "value": "4e4062fceac3d2997ee3627e97a57514fc905c53078b3cd4305add5f18c88aff", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644291697, "uuid": "655622bf-18ee-4ca0-a791-a17433ded09a", "comment": "Malware payload (Heodo)", "value": "cf772803deaa401fdd6a2e6d310d1c9882e211bf", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644291697, "uuid": "d21c4d2f-a072-4415-8ee5-9cc54e98712f", "comment": "Malware payload (Heodo)", "value": "c2f0f48047aa1932e4c126e10992ff4976326a5772378f7788f93010e338e1f0e858d8cc6a315bade318ace790a7c743", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644291697, "uuid": "c99daf9f-21a0-4889-80df-cad34ef9349a", "value": "T116D38D6ABA48CA0BD94913314EE7CBFA7335BC819F5297473295B72E1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644291697, "uuid": "d826f964-82ce-493c-85f6-cfddd86672db", "value": "3072:fcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3s:fcKoSsxzNDZLDZjlbR868O8KlVH3skeV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644291697, "uuid": "b5792229-c3c1-4c96-a98d-4db85cdf1bd2", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644291697, "uuid": "e1efaeb6-df9a-45a7-8a6b-d809f1e74731", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644291697, "uuid": "55f8b576-a4e0-4221-a3d6-9ec9690b2b07", "value": "tmpnkepwz3t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c5f696-88bf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644311642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311642, "uuid": "facb3867-ba95-4d9e-9a5d-4a3179323b0d", "comment": "Malware payload (Heodo)", "value": "b58a5ef4a89dd5b7ffb623c15c8966c1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311642, "uuid": "98f29c6e-90dd-4697-97c7-13c63a9a239f", "comment": "Malware payload (Heodo)", "value": "4e7cf70236b86a8c77b3ddb0e0196a2fd48a63c569ba76b3c507a1659e469545", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311642, "uuid": "20d5f3ea-5522-4d57-8f63-accd499f0d06", "comment": "Malware payload (Heodo)", "value": "7c7a547dc21f0965ed5024e6aaa48d0328faeb98", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311642, "uuid": "c68bd1eb-3d72-4a2b-aee2-6928d7b117fc", "comment": "Malware payload (Heodo)", "value": "c71dd2c48b595ad5af6c93cb092eb1ad88c534db41c73a7597d60e4a4f5abebb8f993c3a872600e87bf72bd9a433491b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311642, "uuid": "f091ab94-f518-4e96-bc41-8af6957b5761", "value": "T15093499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311642, "uuid": "3cadc08a-d95b-4c44-bff1-b64d3d0263eb", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644311642, "uuid": "b8297017-9499-40ae-a82d-aaf3b01a9ef3", "value": 96604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644311642, "uuid": "25db5763-da15-44c6-90c0-bfaa58aecc6f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311642, "uuid": "ebee93bd-16da-472f-88b1-64e81efb517f", "value": "tmp_uf_noso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607b1798-8928-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644356705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356705, "uuid": "4a11b867-06a0-4062-bd21-976475af6d45", "comment": "Malware payload", "value": "189f6c321d9f553584029e00b42aff0d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356705, "uuid": "4bc02432-465c-43df-a471-4b171164d73f", "comment": "Malware payload", "value": "4eb5bb98a2de36bf1603b61a3093b19acb8b6f81b2b07ffb13841e940e6d23e0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356705, "uuid": "fc2ad8c1-1b3e-473e-a0a8-3c01a70f43c2", "comment": "Malware payload", "value": "85c7c70746ff9356459f17c11e26608e9d8e988e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644356705, "uuid": "2707acaf-639c-44d9-b58d-6c0741e1bce2", "comment": "Malware payload", "value": "a2bc42a251502f965d47e0a2ac7f7b43904f347d554dd758da2f7fc058beba5be3881d40709eb032ed60089b3026a6d1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644356705, "uuid": "5d88ab8f-38f0-4fda-8ab9-2be9aa9582db", "value": "T144C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644356705, "uuid": "8e085534-db6b-4c74-a167-9a9febcb51a8", "value": "3072:mEcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBE:tcKoSsxzNDZLDZjlbR868O8KlVH37keM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644356705, "uuid": "1076278e-3505-4b05-a369-5269f889cbdb", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644356705, "uuid": "0ab82e08-dedf-47a8-bace-301742d1773c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644356705, "uuid": "a04f2831-357e-4831-90fd-82442941762c", "value": "tmp7p0imegj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5246627-8891-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644292100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644292100, "uuid": "a8d88721-8bae-4925-b33a-2ce9368a08b7", "comment": "Malware payload (Heodo)", "value": "5ec6b01e48ddda59bebd55ed9b7e5cc1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644292100, "uuid": "370dd7ee-ffce-44a1-bfb3-378d47e9f9b4", "comment": "Malware payload (Heodo)", "value": "4eb6e0c350568c1a0738f61b504aa325ce60d1215ccf48efcd3a01f3b98f3cc7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644292100, "uuid": "8c21aa2d-6dee-4534-af3d-8f09a56524a2", "comment": "Malware payload (Heodo)", "value": "657ac3f886dfd5ea4ba769420e379e7a81d77a35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644292100, "uuid": "68f7d760-5046-4c7c-8d91-b55225fd7e40", "comment": "Malware payload (Heodo)", "value": "34fe0c80ff4c3684f4d36d31ec15eeb762d28110c56e1a83b7d6c6d16119d791c482a9799a95017cc505d354925c6faf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644292100, "uuid": "714d3dc3-f0b3-4d7d-bcab-99d27966d106", "value": "T141D429AB3A8FA1BDF17B017A6350FB44E4D27C1A9FBD25D70A86358893F2D054F18A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644292100, "uuid": "74ce1639-8c4d-4e7b-bd40-9d6e9bfe441f", "value": "bf1ebe22ec6f51f906ec295a3a5c6d92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644292100, "uuid": "fba85272-56fb-463d-8214-617a56165b67", "value": "6144:x42k6LwFPw91EDbkUE39P7pyADYzqlEDFmZ4s3wADncvIpxUIVZFoEXlbeZhp4ga:x409qDb109PdyOYzq3F3fVbeFTi40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644292100, "uuid": "c738114f-82bc-4041-8a2c-8775781b7e5e", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644292100, "uuid": "6e9a4451-d4bd-4239-a5e1-f6d97334a723", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644292100, "uuid": "8f865935-a3fd-4d40-b075-0b8d963584cb", "value": "5ec6b01e48ddda59bebd55ed9b7e5cc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "792394ce-88c1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644312508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312508, "uuid": "390bb87c-f9c7-438a-80ca-e775fe0016a6", "comment": "Malware payload (Heodo)", "value": "2c2eda3d6a3340dcb3f8c75752194fac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312508, "uuid": "48118c01-a3c4-423d-9079-b5707c13c5f6", "comment": "Malware payload (Heodo)", "value": "4f23dacce2c36072d46529e31ac51ee16518b143aeb226c52bfbd4a302891940", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312508, "uuid": "0c0ec64d-1122-4b81-b5af-843909ee17ff", "comment": "Malware payload (Heodo)", "value": "b5918b435e1cace72aa634d7fc2fcda5e98441e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312508, "uuid": "cf695e54-4d22-4f9c-9e67-3892c0b989a1", "comment": "Malware payload (Heodo)", "value": "0be0a243eba5646d90d779153a180041e00cb965d6ed5b9dfd7aeb2c8e236a72c0645998095932a1f13fe03a339c60bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312508, "uuid": "294aff9c-079e-489e-8553-3d281490c129", "value": "T15BF4C0006582907AE4F930B842667BF1E93D1CB0372511D39BD069FEA6E41F1B6B376B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312508, "uuid": "3dd02afd-afa1-479c-91dc-9e3f03f16b72", "value": "36d18f8cb3bee16af0421e6a936157a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312508, "uuid": "f9227989-0c48-4241-b767-05d3820ef8c2", "value": "12288:lBseOTwOg957PAMTEFv49thrFcmxLFwD7wGcXbtzbEOpUDlB1awsoei4:keOTwOUPnTC49LJxJwaCOpUD78oei4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644312508, "uuid": "6fcf6e78-ba3b-483a-bf48-7330b80865bd", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644312508, "uuid": "9cd31839-402e-4c5c-8c7e-6bf43a60dbf9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312508, "uuid": "28b31c72-6bd3-416b-989d-c8dd6e56222a", "value": "2c2eda3d6a3340dcb3f8c75752194fac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b250912c-8917-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644349541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349541, "uuid": "96607fba-a3bc-48a1-8300-11a142722ac3", "comment": "Malware payload", "value": "04c1f0b21f8b10217caad9dd484c0489", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349541, "uuid": "04b5c6e9-cc73-41ad-9788-ed9e380f528b", "comment": "Malware payload", "value": "4f4b5ae0f0189074748699df099160023d7b54c5f078d8ae449066bb94479811", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349541, "uuid": "7e82cd0c-4085-44c6-8e12-af5e6964d3a2", "comment": "Malware payload", "value": "7d17ba766c1901ae882a80371b68e29efc04bc1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349541, "uuid": "fa95394a-3abf-4df9-bbaf-8f48f219c8f2", "comment": "Malware payload", "value": "1e6843c8d70328c6608350eb24d95b4f96b46f0fcf2ada0ddb6f07592ba15bd18757eb83ee14438d515eebcb3ab34c0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349541, "uuid": "d6ea9493-fde2-4df5-af50-46629a463227", "value": "T10CB47A3F89BF113AC6BCCB7199D0CE1FB426C5963977692D269221D904232F275D222F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349541, "uuid": "014f5d6d-38e8-4d79-a9c8-3accdad087f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349541, "uuid": "47a12141-0ea8-4009-b1d7-6bce38280b24", "value": "6144:Dfx8ZMP4JDbQzARuKOjaib1TP6A9e4rKMaRPRzonQRNR1ZA2IfuvBmGRWyH:Dft6fQ6nnib6A9e4rBKzIyrjAkJmJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644349541, "uuid": "7e7865b1-ab88-40e5-bb56-f50036911e7b", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644349541, "uuid": "58496aae-0f2d-4b84-927f-6e9c98456a24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349541, "uuid": "bd7632c5-f30c-46dd-b1e8-669f2393c29e", "value": "04c1f0b21f8b10217caad9dd484c0489", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc6bffe-88b1-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644305724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644305724, "uuid": "6e10c5b0-a2d8-4940-8c04-910c71ecc86d", "comment": "Malware payload (Loki)", "value": "fa31abd22044b96fad8f49b23073bb86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644305724, "uuid": "077edeb9-8f55-4e6b-a885-b018a10f9d03", "comment": "Malware payload (Loki)", "value": "4f4e2371c3a52e1ed316343e2bdec94a832793794c820da4be035e865fd15931", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644305724, "uuid": "71d47310-dd1b-4be9-9338-ff847aee9755", "comment": "Malware payload (Loki)", "value": "0f4348dd6ad2b7aa7d33091ddbc3272356a93088", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644305724, "uuid": "b80cb48f-c920-4140-9e52-964df323bed9", "comment": "Malware payload (Loki)", "value": "eda698949649b7cd631d6679dbf4bdf406e79ade042bb1c6b37b581b06f1aee99123c0e9f511e3ff6b5fed1a765196fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644305724, "uuid": "976f1265-0165-4eb1-aaaa-835c9dcc99b5", "value": "T14494593F49BE213AC6BCCB7088D0CE1FF426D5563977691D2A8626D905232F275C622F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644305724, "uuid": "125e5efa-a0ee-4cd4-a8f5-129da8e9b4aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644305724, "uuid": "f7ec6381-8645-4767-b506-f9466b308a9d", "value": "6144:6d9uPgJD8/ryS4YsAOj0RpKpgSV7jReAevzyvtEUPaWQVMkttUmF:66iA/rFS5pguJeAv1NQVBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644305724, "uuid": "f6bc5dd9-5da9-40c8-b616-996d6671b792", "value": 445440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644305724, "uuid": "fe6a2bd8-762d-420d-9c65-23d7bf06e520", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644305724, "uuid": "a5152120-7628-4520-a4af-9d027508b02d", "value": "dJKjhElXVEgxxsn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e75f352-88c2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644312866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312866, "uuid": "3ddf7922-0725-4faa-83a9-d2901c5b2974", "comment": "Malware payload (Heodo)", "value": "e5315df7818218a99951990568358a96", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312866, "uuid": "cfafa9d0-b8f7-4306-9bb1-c94727a2c0a9", "comment": "Malware payload (Heodo)", "value": "4f4f938c3236255a414af2e853a89cc6d19c5fd7873154c6e99d0ebdfc95fa61", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312866, "uuid": "4bea8341-f26c-4113-854e-52a36706433d", "comment": "Malware payload (Heodo)", "value": "9013a6d7c081f006e72cad51847b468b8f681fc6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644312866, "uuid": "dd555674-682e-4dc8-8141-dad4901087c5", "comment": "Malware payload (Heodo)", "value": "3cb4de97c2471783ecafbc4c800b89006162ab541bc889d5b02af2ff482322e6af83a058ff60b269f6aad1ddfba47b55", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312866, "uuid": "24453c29-7d82-4fe7-8d84-e537c671c647", "value": "T1A093499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312866, "uuid": "1f6efd62-101c-4fed-b02b-4f3679ae3e6f", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644312866, "uuid": "4bb44b50-7d1b-4bfe-b360-49357a140c1f", "value": 96748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644312866, "uuid": "c9ea52ce-00f6-4f59-bbce-60f07c60f5bb", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644312866, "uuid": "1defbdcc-6a1e-4b72-a510-34233cab0303", "value": "tmp81_owmp7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed704fc-8880-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644284627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284627, "uuid": "ec562089-b93b-44be-ac3e-eec55b561bd6", "comment": "Malware payload (AgentTesla)", "value": "f9b8c2a25dd957d29be0389971b39e10", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284627, "uuid": "968350c2-432c-4200-a613-5c509b8fa8e4", "comment": "Malware payload (AgentTesla)", "value": "4f6383c6ae7c88ff6ab189dc208b3f159d87b824011a697f438a218fc07fa3bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284627, "uuid": "4f024cd5-d8c0-4a4c-8413-2dd9dadcb62b", "comment": "Malware payload (AgentTesla)", "value": "04cc1fbff9d7e99e2f5c684775b0bf437306f190", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644284627, "uuid": "fc64a8d3-684e-4b7a-8591-f991304c48b2", "comment": "Malware payload (AgentTesla)", "value": "fa187c28bcf84c5a2a115e2ecbd7701832e343ae2ab02ea97e52c4f8a6d8c5d12b40f2821396f21a5287d90c60b65c9f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284627, "uuid": "a0f6358c-6342-4f71-b90a-aa32420e3dd1", "value": "T14A05DFAC329179EEC41BCC329A687C60A67171B783CBC2139167129C9E5DB67DF104EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284627, "uuid": "f422f48a-7f13-44d1-87fb-7c33fa0f6334", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284627, "uuid": "59ed007b-10da-466f-9752-1361d95da7a4", "value": "12288:iON8sufHL0UEef4B+lg6RFrJElsDRiiPr+ZMKeon20KIzZ+YzUbd6ZWy7Mp1p6/x:ihDfL01ef4BWbrg8RPrMMKd3NlUFE1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644284627, "uuid": "d17c86ad-1302-404c-8e1a-b7dd96970697", "value": 839168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644284627, "uuid": "4e97c044-0096-49ff-8670-5ac478be1e9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644284627, "uuid": "bf33ed77-e1f5-48df-8f02-ad9632a352df", "value": "f9b8c2a25dd957d29be0389971b39e10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f850f94-88dd-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644324545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644324545, "uuid": "fb4f8b9e-6222-4b2c-8550-62233dd2d299", "comment": "Malware payload (AgentTesla)", "value": "d6ec51066d189c88eba391df031d5f6b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644324545, "uuid": "4df6c5b0-bc4f-4a0d-b42f-d2ed16f2e15e", "comment": "Malware payload (AgentTesla)", "value": "4f6d6ac4330825cad3549d724670c5927940928df92537ca529eca5b31c0e4bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644324545, "uuid": "aa50496a-b6a8-4125-9ac8-eb96504d7bfb", "comment": "Malware payload (AgentTesla)", "value": "a2fd0eb6d26256b5a1df0852a63fdcfe4f55cd85", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644324545, "uuid": "1a12bdc7-0776-469b-8b40-e33dc946b92d", "comment": "Malware payload (AgentTesla)", "value": "b2fdebd841dbbdff699eb5fe58716f54d0f56838580114ae67b36330e24889041dc2135b7881ddff7829e6fd6efdffaa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644324545, "uuid": "bcd49e0b-32ce-4bf2-b2b7-02ad59e4c5d9", "value": "T168C48B2F49BF213AC6BCCB7198D0CE1FB426D5463A77691D2A9225D905233F275C222F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644324545, "uuid": "a9db2827-75da-4875-9c08-f715c41aff16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644324545, "uuid": "161bad92-810b-43e1-b28b-f458b8a5cfb1", "value": "12288:cRD0ENg1oVHkyurCMAkp3X2fx27x174YsI8aB:cRDY1cQCJLfkF17rNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644324545, "uuid": "08b5eaf1-96e2-4516-b4bb-0bef4dd165d6", "value": 575488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644324545, "uuid": "ec4dc01d-5a10-41d8-9f79-f7830163c634", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644324545, "uuid": "24c1c687-d668-4f5e-856d-68f53c42bed6", "value": "Fatura Pendeintes.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e392b80-88c8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644315442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315442, "uuid": "b9ec581e-f832-4d85-93bf-3fd53f992165", "comment": "Malware payload (Heodo)", "value": "13ac2cceeaf7a52adff77253b27f9682", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315442, "uuid": "d6eb4a86-ae6b-49f1-8397-ca012be96390", "comment": "Malware payload (Heodo)", "value": "4f9137dc3b69b5b21ce33c22147d5b5b9d68bf9205e9f21750b9e0d6b48fa385", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315442, "uuid": "430fc997-d318-41b6-b1fd-cd3cb975a4e5", "comment": "Malware payload (Heodo)", "value": "f67a6916e406e40649bc5f7d7f5631ef824221e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644315442, "uuid": "cd424266-c272-4bff-886b-87ba6429e64a", "comment": "Malware payload (Heodo)", "value": "73b9808868d176b94f3adc94e31d00ee1d9c9f923ee5d4bb4859ed0a40511b52bda33020392b00fd2e2e69e8a3a9a8da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644315442, "uuid": "ba604623-fc78-4486-bb8b-b50731a7fffb", "value": "T150F4C0006582907AE4F930B842667BF1E93D1CB0372511D39BD069FEA6E41F1B6B376B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644315442, "uuid": "a149c3d6-96e2-4b12-96c3-eef79c5c712f", "value": "36d18f8cb3bee16af0421e6a936157a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644315442, "uuid": "91d8c5d9-1c94-449f-9337-9f2118b14d95", "value": "12288:lBseOTwOg957PAMTEFv49thrFcmxLFwD7wGcXbtzbEOpUDlBjawsoei4:keOTwOUPnTC49LJxJwaCOpUD76oei4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644315442, "uuid": "dd34ad43-0798-4b86-9ca4-a07c694b6465", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644315442, "uuid": "598109bb-87f1-4bd8-960c-cd01978a3382", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644315442, "uuid": "657000e0-4108-4718-a158-50ad230eb379", "value": "13ac2cceeaf7a52adff77253b27f9682", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "621ea170-88b5-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644307315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307315, "uuid": "e210dfd9-3d96-41e6-9baf-a9c2dda1930e", "comment": "Malware payload (Loki)", "value": "3d921421a4efacab39fc163d9fcc16a4", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307315, "uuid": "2baa564d-b5c6-4032-a287-86fa7a348358", "comment": "Malware payload (Loki)", "value": "4ff933b4cad3a9f231d1c38bf20a27400efae812d493970abf73a74cc6d146f4", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307315, "uuid": "510e4023-0b91-4e86-a567-df849faca99c", "comment": "Malware payload (Loki)", "value": "fb44ea97a3c20b950eb7aefbf1254fdeb84ee411", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644307315, "uuid": "ce98f891-1bef-4e68-88ad-5c43e7c8f3a9", "comment": "Malware payload (Loki)", "value": "dcd67a298742a2d7adec8892f82a2de8638433bd14a56eaeb1b142354e560eddb5657e86a1a6c2092f9f3ba7cd125ba2", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307315, "uuid": "91e87ba3-f246-4447-ba2f-c0edd0efe55a", "value": "T19214121BFEBD9913E8F0423773E498EC55A95CB568339210724A38BC997ECF4D36840A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307315, "uuid": "3ad6338a-c586-41f0-aacb-3c6a10919db9", "value": "3072:QOlXgfaWpONAgtk8oHcav4BGjAO6ALLthJU7AzHDp4ArArOgQQoBo:TXWVpONAl8oHcavyGzLzm704kgQQoBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644307315, "uuid": "17b11408-6a7e-46e4-b065-848a532bf1d0", "value": 191976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644307315, "uuid": "def2ccc4-b828-4f2b-8302-b65b62ce20a3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644307315, "uuid": "c9c07a1b-bc5a-4c6a-bfba-048153d72b11", "value": "TT COPY.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7720fed-88d4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644320746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320746, "uuid": "453cfe92-ccb0-45a0-9199-9e0475471008", "comment": "Malware payload (Heodo)", "value": "cdc91dddff8df0ea43550ec14d85477e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320746, "uuid": "1443426d-a38e-4b92-b8a7-280c78b7cea2", "comment": "Malware payload (Heodo)", "value": "5013708d50f44169e12b600ba17ee4b297853bd746aea3116bd83735573ac436", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320746, "uuid": "1ddd03d9-00b4-48e3-85de-0dc0bb762d8d", "comment": "Malware payload (Heodo)", "value": "499c7c189614f492c98992976a3996b8ebd3cf59", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644320746, "uuid": "b7ac82cf-ade5-41ec-ac63-56de6c664f3e", "comment": "Malware payload (Heodo)", "value": "e73082173eae8f135d177e312c98f75f32de8a37dd11529528078ccae7bb8073b0280c6298b045ffc886941941664eec", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320746, "uuid": "34d44618-202d-4340-b30d-27df3679a4c5", "value": "T15AC36A43B7C0CA56C62647F56DDB87AA6B36FD218F5623C7310A7B1E3F700909913A1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320746, "uuid": "9accb775-931e-4fc8-8454-8df27e948c84", "value": "3072:/t5+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdESUzjlk7XcLi4gbxsLX5c/lTpK8:X+HEAnWJnvb8eYYgoMbqa6Wv+W2xdESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644320746, "uuid": "a85ca36d-e465-4bad-9d4b-0a9615a3c7ff", "value": 127824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644320746, "uuid": "53c3e945-6eb4-4d90-b278-231b394383cf", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644320746, "uuid": "bf03b84a-6bca-4cae-8eb1-921ccd99df7b", "value": "tmpwa4otubb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb699a9-892a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644357693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644357693, "uuid": "d94a30c9-f434-4e55-8a59-95ca09084f55", "comment": "Malware payload", "value": "5ba55f49b8bafc02f7a70fbbfd8cf13c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644357693, "uuid": "43c1e4fd-96d6-46d3-a0f2-70f6e7945fe7", "comment": "Malware payload", "value": "50183427be6a678778424206767f94fb8a807abe00bd630de081904c3851130c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644357693, "uuid": "2a3e175c-37b4-4350-96e2-859c005b1b72", "comment": "Malware payload", "value": "b96130a59a20d7878d6767eb1f8c2f5de2bb9b9e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644357693, "uuid": "5283e507-7a28-4fc6-aee5-88e5d04a6d28", "comment": "Malware payload", "value": "feaeac62e1487d3d0d0a626f0d65ce29ae5d32d654745ff0a80d798a9216a41dc24a62fbec732095668f0698fb071f4b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644357693, "uuid": "92ef8b1b-4026-4872-b129-7cc759c572a1", "value": "T145C35A55F685EA1ADE0823350DDFC7F9733ABC828E9683473289B32F7D76550CA12606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644357693, "uuid": "026fda51-1a86-479c-83c5-548b76ff1938", "value": "3072:XfcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBv:vcKoSsxzNDZLDZjlbR868O8KlVH37ke3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644357693, "uuid": "4482cbf3-5449-4998-a1c5-e1c233a3fa2e", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644357693, "uuid": "1a363989-659f-40b8-b6a8-374f9edebdc8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644357693, "uuid": "29b8f499-95e7-4dce-b5ff-a46d32bbb6ae", "value": "tmpoieulo4p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064c8e15-8915-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644348393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348393, "uuid": "f5217c8d-45ca-43ba-a012-adb3c10cc4d2", "comment": "Malware payload (Heodo)", "value": "89d44b6fd023e9dd150e80ab8e2d050d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348393, "uuid": "1a494bea-004d-4772-896b-2e715309101a", "comment": "Malware payload (Heodo)", "value": "501a4891ac4edde15ce2f861cda3bbe8691523ae8684e88f9063884ee6fc8920", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348393, "uuid": "8f086292-bc29-450a-81f3-85826e89e0c5", "comment": "Malware payload (Heodo)", "value": "f22b77202a3ad6cba195552b23f71524aff63e1c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644348393, "uuid": "66246c9a-06fb-4ae7-b493-e62873e69318", "comment": "Malware payload (Heodo)", "value": "a4b472c497a999d349bc39777e53abebfff26ea87b0efdfe2adfec60eceb9d4b206da0e276e68b1e92b28ef1f0956179", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644348393, "uuid": "1b9132f4-ffa7-458b-bec7-55f93907f28d", "value": "T18BC35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644348393, "uuid": "a7fbe105-7ab4-418d-a595-b86a72c669b5", "value": "3072:cLmfcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgO:c6fcKoSsxzNDZLDZjlbR868O8KlVH37C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644348393, "uuid": "ff74254e-4cea-4ca9-84ce-fd71bbf50b3c", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644348393, "uuid": "c48cbc6b-3123-4848-b23b-0e0e3f5d8da7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644348393, "uuid": "93011ba8-26dc-4d8b-9d7b-af793dfc3d7e", "value": "tmpdaokqpo4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3934ea-88bf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644311574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311574, "uuid": "26c15b17-0d89-4974-9bc3-f7c07b4947d7", "comment": "Malware payload (Heodo)", "value": "e14e1f70b5017b24e974ced57d431f6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311574, "uuid": "14364f92-fd47-435a-8253-2006aa815706", "comment": "Malware payload (Heodo)", "value": "50433febc90d43b5ceebe9c7d558dc07b9b7ff0291b41a72a5acab256f3ed43f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311574, "uuid": "20cefc3c-7b31-4bcd-856b-89c069d96a27", "comment": "Malware payload (Heodo)", "value": "e38bcf31e93dfa0a2d75fbea1384a73b12461530", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311574, "uuid": "785edcb1-6d91-4e5b-84c0-93dbde6e48db", "comment": "Malware payload (Heodo)", "value": "d1e2ba2464f41d24c37890d0e2b289b87dd497fda6042b56f328846ffa3a4c0010e4a59924712f0900b9ae825f58d777", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311574, "uuid": "b353ee85-07ab-495e-9034-918f0e8e599c", "value": "T1D9D429AB3A8FA17DF17B017A6350FB05E0D27C1A9FBD29D70A8A758853F2D054F18A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311574, "uuid": "d7548d09-1329-4b35-adc8-29b0e0c9bc7a", "value": "bf1ebe22ec6f51f906ec295a3a5c6d92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311574, "uuid": "e223d2ef-4ef7-4b88-947c-ce3020748099", "value": "12288:l4WjRiEKWKhqyuYzqtNTH2AyKK6cl788IO/:9KWKh/ZqtJ2AJuQBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644311574, "uuid": "15500096-b81d-4795-ab67-11630930a9b9", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644311574, "uuid": "6f2f0d62-6b56-42b5-b7ba-10117be9ca96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311574, "uuid": "1c138d9e-ae17-450c-b154-445ad05b63b4", "value": "e14e1f70b5017b24e974ced57d431f6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1495bda-88be-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644311340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311340, "uuid": "daf24a19-48be-47a0-aa41-0c8837a54a24", "comment": "Malware payload (Heodo)", "value": "cdd74101b68cc67004b8ab9ddaa096b7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311340, "uuid": "94e077a4-b309-4d50-8dc9-3946a09e3f95", "comment": "Malware payload (Heodo)", "value": "505db6f7db0a368a0b7b4d0638618d0f42784b1755ac4983d2ba38f812d3e226", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311340, "uuid": "14268770-9701-416f-8dbe-cf055941b792", "comment": "Malware payload (Heodo)", "value": "41fa16c63cf6b228389a4cb81a637bb099e04967", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644311340, "uuid": "8b294c30-fd7e-4767-b186-c620e957dddc", "comment": "Malware payload (Heodo)", "value": "2e2ae069e53a911cea4d9720419d3cd02196287b0ce0dff5e2014a6436467b9ba734fb977e022092891398b3c0a93a9c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311340, "uuid": "aeaffce9-e77d-4701-8e5c-e79c867988b3", "value": "T1D6D38D6AB648CA0BD94953314EE7CBF67336BC819F5297473295B72F1C3A580CA03B16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311340, "uuid": "7deac331-159d-4a76-99bd-bc0a63c53612", "value": "3072:acKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgDa3r:acKoSsxzNDZLDZjlbR868O8KlVH3skeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644311340, "uuid": "587cf68b-de49-4e93-becf-bdf5cdf5e779", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644311340, "uuid": "b6b4278b-b63c-45cd-803a-ed2efd896870", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644311340, "uuid": "dd35d3be-8dcb-4993-8ed2-2f08aacf8952", "value": "2022-08-02_0942.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681010f0-8918-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644349845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349845, "uuid": "8580f2f8-9a47-471e-8591-8e0f7aa6b1d4", "comment": "Malware payload (Heodo)", "value": "c475730d0c8cea817400573e71923905", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349845, "uuid": "0c6bf658-b1ec-485e-95e8-285e7ec09906", "comment": "Malware payload (Heodo)", "value": "50646012cc264b1785ee4fad94c070fbc782eba2aba40275330876ab6d4a6d51", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349845, "uuid": "48ed29fb-2578-4813-a9cf-fcb5802ece18", "comment": "Malware payload (Heodo)", "value": "5ca7251c40eac6567cfec413f2dec85f1ccc7ea4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349845, "uuid": "99d47729-5a63-46e0-a3e7-81b6a78c66a3", "comment": "Malware payload (Heodo)", "value": "5d4670e04ccaeffc1ea84d816db21744abcb9f07dae0f9b01208d5b0d352595068035c7ebc924fb1c7540457dab194ab", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349845, "uuid": "8bc0b005-0e93-44f3-baf7-5a919561defd", "value": "T1B4C35A55F685EA1ADA0823350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349845, "uuid": "e59c376b-06bd-40ed-8237-2379d2fd69dc", "value": "3072:cKcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBa:hcKoSsxzNDZLDZjlbR868O8KlVH37kei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644349845, "uuid": "cb4ffaf0-6409-4b80-90fe-c8901a2732b2", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644349845, "uuid": "dd94c58f-0939-4c3e-a9f1-593102284846", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349845, "uuid": "c84ed05e-c691-485c-aecf-26652ff3916a", "value": "tmpga1y7x2z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf08e8c-88de-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644324834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644324834, "uuid": "1e9643c6-7fee-41d7-9d09-61fdbd1eaf5b", "comment": "Malware payload (Heodo)", "value": "fc991adf4fa34721c8ce714fc84588bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644324834, "uuid": "6814ca5d-2b94-4b9f-9600-c794acfc8544", "comment": "Malware payload (Heodo)", "value": "506a7728268c78ee1dc4904005da3c5c88a8b440f58974248650c876c5d845a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644324834, "uuid": "3cafe61d-0e91-4787-860e-fb1ed0a5a32a", "comment": "Malware payload (Heodo)", "value": "c3d5da838c05cd98cba88e08b2c80fe50be87692", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644324834, "uuid": "e34b83e2-a9c7-4ed6-86f4-db96abc84ab2", "comment": "Malware payload (Heodo)", "value": "21ba5814ae7fcc86f9fc112a3c6de5f415d769e2573af7d374eb83eabee14ab94c2765140579b8860c62795cc231fb0e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644324834, "uuid": "376fbac9-9180-40d0-af19-674405089b9e", "value": "T13EC43A12AA82B0F1C79C813EB3F97AEB903F146547AA76D34FB18C8965EC0D119F7911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644324834, "uuid": "1f2b03cb-a9e4-4369-8391-482b57014166", "value": "1059dec3a72d4c311e39c8fc33d5af98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644324834, "uuid": "aa792fad-8494-4751-b08a-e61ceba214c6", "value": "6144:PQXvqLl4JINqB9QqbJq9AbuR/RzZ+fR0c96lnVPk5XtlOkiETHyROnR:oXvQDQVq9Ac5ZuRp6lRkzloEzyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644324834, "uuid": "7fcdfae7-8d7a-4990-b4f6-b4f22a325818", "value": 596992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644324834, "uuid": "fb70093a-edab-4ff9-aab3-949672d6db96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644324834, "uuid": "f88d7bd3-7a07-4e75-b1bb-114b2f0b27d4", "value": "fc991adf4fa34721c8ce714fc84588bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ff938c-8916-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644349191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349191, "uuid": "31645232-80d1-4f34-9bef-c1e24f17c07a", "comment": "Malware payload (Heodo)", "value": "1fe0c0eae56a7fd0d2b06c0d52b9e570", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349191, "uuid": "2957948a-e39d-48f7-b7a8-eb25043de6f9", "comment": "Malware payload (Heodo)", "value": "508832fb242ef222372093b83245ac686a62ceebc424ab816f0919bd3d601892", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349191, "uuid": "560c9e6e-0e41-4b42-9197-2a2cdf03e6b1", "comment": "Malware payload (Heodo)", "value": "4531db2c221b71c24169f727afcde8a94938ec66", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644349191, "uuid": "9db985b2-0dfd-41e8-8233-b2b9b9a24f50", "comment": "Malware payload (Heodo)", "value": "71e56e0c2b4070725a7bb4f67ec09b95b35d522bb6b7a4b4ee32d4bd7323787c422eef233228f57b8321da9d6fccecc2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349191, "uuid": "ed44ea62-85fb-47ae-97be-665e4d55de87", "value": "T102C35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7C76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349191, "uuid": "c0644f89-5165-429e-96bc-5c5a4ba3e45f", "value": "3072:ttcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgfBV:DcKoSsxzNDZLDZjlbR868O8KlVH37keN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644349191, "uuid": "a02f4835-5bee-47b2-b4f3-635a7d511cbe", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644349191, "uuid": "a1088c54-ece3-4224-8747-a9c378766b82", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644349191, "uuid": "4fe1dfaf-e0e0-44a4-bb2c-5e542307685e", "value": "tmpljkysnn6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c1347a5-88f6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644335276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644335276, "uuid": "74350847-8d3e-40fc-b31e-8605a2274921", "comment": "Malware payload (Heodo)", "value": "1758c212d13724e9a7249bb451745f32", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644335276, "uuid": "00b22c85-5915-47dc-addc-bf57df4a6419", "comment": "Malware payload (Heodo)", "value": "50a2f8678c88c3aa33fe1bb143c1ad17eb5b99ade7ea3469610759245afdaec0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644335276, "uuid": "0854295e-b250-44c1-bc14-952d6aa2dc02", "comment": "Malware payload (Heodo)", "value": "8ba8936b035d302fbde2c3d60c12302c6ac3a36c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644335276, "uuid": "38ecefa7-c1f6-4db9-ac26-87060746670f", "comment": "Malware payload (Heodo)", "value": "2060d9a5b03c250efeaaa364f3058068e8e76833435713867bd6d9a60de8f1b7aa3e045ead12107441f11e0742cb4f63", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644335276, "uuid": "d9e1c78d-ea96-4ad5-bbf8-16ed542c5eea", "value": "T1F4C35A55F685EA1ADE0822350DDFC7F97336BC828E9A83473299B32F7C76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644335276, "uuid": "f3195ad5-bdc7-4c19-a306-abfd2f0b5640", "value": "3072:kjcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dg+Bs:scKoSsxzNDZLDZjlbR868O8KlVH37kex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644335276, "uuid": "477be301-7928-4bcd-af90-a1d0cfdf7218", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644335276, "uuid": "859bdb3d-b818-4682-ae68-a8520a33ecf8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644335276, "uuid": "28d4135f-0ca8-473c-8ae8-09decfb66f0a", "value": "tmpgyjiygt4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af104cb-88a6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644300753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644300753, "uuid": "ebba4867-885a-4118-800d-2231e7f550f7", "comment": "Malware payload (Heodo)", "value": "3283b0c087c8bb3ed6e6fbf057cfd840", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644300753, "uuid": "61d4ea29-9921-4462-804d-d2a78a6ce839", "comment": "Malware payload (Heodo)", "value": "510538b827414c1a1c5023cb09880e2a44dee6f35be483a0f0c943697db3d112", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644300753, "uuid": "12538f2d-91a8-43ac-b045-ac2254f35487", "comment": "Malware payload (Heodo)", "value": "5b707b5fe9a0f8a13d50de3ffc1b77d83a79e0c0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644300753, "uuid": "3499b068-04dd-4472-9a66-6bd8e256f52c", "comment": "Malware payload (Heodo)", "value": "bad696a97da5b94fb2da29662dc82906031fc99d3b8a22d8549fdfb8b8a429ef3aa7713e4e68134d15208568ee9749d6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644300753, "uuid": "5783625e-c3b2-4ce8-9ccb-a6fb7a46b788", "value": "T175D38D6EBA48CA0BDA4913314EE7CBF67335BC819F5297473295B72E1D3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644300753, "uuid": "65bb27f5-c705-45be-8523-f722169500c2", "value": "3072:ecKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3q:ecKoSsxzNDZLDZjlbR868O8KlVH3skeD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644300753, "uuid": "89cb0981-30fe-4d23-b9fc-70739bb0211f", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644300753, "uuid": "f6040906-d510-41a4-9d76-0c0736daa836", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644300753, "uuid": "51d3631c-7190-4715-a1d5-8a290f2af3a7", "value": "tmp8h72zc01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fbf5b7b-8912-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644347201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347201, "uuid": "e41c8cef-8d9d-47c4-8644-7ee70ddc3dd9", "comment": "Malware payload (Heodo)", "value": "24544a382c6289ec373736c85fdb0974", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347201, "uuid": "8493fe78-9f23-47cd-a34c-6ed175a85943", "comment": "Malware payload (Heodo)", "value": "51261a9c5591bd842f2506360a3f99534d2e2e65dd8ce06805e9efd7e72cc727", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347201, "uuid": "b78c195f-9d64-4811-837e-0eeb80f109a1", "comment": "Malware payload (Heodo)", "value": "e059d4c99f159c12f6639712d236919e2880dd6a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644347201, "uuid": "f71558e7-5943-4d54-b802-f38296c1a6ec", "comment": "Malware payload (Heodo)", "value": "853534a22a3443dc8d0d2db8872f36156a2733f6ef8271ab554c0810015708ae326eb49a85bd7cab6014a1ed683599a5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347201, "uuid": "2d47653c-7e4f-467b-883d-cd27f874b6b5", "value": "T1FDC35A55F685EA1ADA0823350DDFC7F9733ABC828E9683473289B32F7D76550CA12706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347201, "uuid": "48ca8308-1fc1-4e29-888a-e85e439afc55", "value": "3072:8kcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgLBg:rcKoSsxzNDZLDZjlbR868O8KlVH37kes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644347201, "uuid": "002d40dd-34b2-4df2-8776-cffbb10b78bb", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644347201, "uuid": "3b484139-c584-4a74-87bc-a6c484f50b53", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644347201, "uuid": "389e4e72-9b99-48e4-ae72-e7455867ff51", "value": "tmpkcdchvxc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f0c9f9-88bd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644310647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310647, "uuid": "282b2cda-d359-4d25-a8a4-f9bdb2da403b", "comment": "Malware payload (Heodo)", "value": "56b32477758609db692bc241770db223", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310647, "uuid": "7389e9fc-7726-4c69-a802-eca4b32dc344", "comment": "Malware payload (Heodo)", "value": "513392fb42c03fea8777c9deb92f36026ec099ad935435a3af5690d9730d041c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310647, "uuid": "4467dfa4-c522-4538-ba52-2c4b8309057b", "comment": "Malware payload (Heodo)", "value": "7049d99448c974d54f54b5468b8833021b702144", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644310647, "uuid": "0a80a8e1-37bc-41a8-b2af-1d0495f8bc5b", "comment": "Malware payload (Heodo)", "value": "4e8f77702de0cd065402838a4ce3bcb2c23b27d2c0ba819c86ada06c60e042639a7539e9978d92310ec42ca726719b0a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310647, "uuid": "ab212b13-2745-4ee4-b7dc-5137299e4449", "value": "T1B693499233D1C845DB22073A4DD697BA6776FC128FA24347324AB74F2EB29909D13B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310647, "uuid": "aa936bec-05b9-47bd-b107-a99042019973", "value": "1536:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2xdEc/Peu7Q1xOj5272BvqSK15+lS+XlQD:LwS+HEAnWJnvb8eYYgoMbqa6G/v+cL2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644310647, "uuid": "7e7eee21-31c1-44b2-8806-67698888f066", "value": 96373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644310647, "uuid": "8495c513-0808-4e5f-8407-ad2a8d3ed82e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644310647, "uuid": "1d83bb92-4f55-4322-afaa-22237f5fb6ec", "value": "tmphywpkua_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3933dc-88a8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644301855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301855, "uuid": "99e4b0c5-f289-4715-8052-9c4737b349a9", "comment": "Malware payload (Heodo)", "value": "e0ad68c365679ad942e492b60526ff3c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301855, "uuid": "c67c5f74-4704-451f-8b16-40029ca0e159", "comment": "Malware payload (Heodo)", "value": "517cefa747a561d3672606427f2c19a7dff092db072444a3e9801aed26dfd9c3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301855, "uuid": "5ef73c59-bad6-4a6f-b1e9-19f19cc71f50", "comment": "Malware payload (Heodo)", "value": "5796a9b4e89bcef9b060302aa02a711f68a9aede", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644301855, "uuid": "1dd059ea-01f5-4755-98ab-5cafa35ec88c", "comment": "Malware payload (Heodo)", "value": "3954d91078ac2850600059f2e3f1db42e955941140ec82c2b4872e8686389b39f0d7b3c74bcb6edfa55aab90d398b043", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644301855, "uuid": "3146ca9b-d646-4a11-b884-0997e43d215c", "value": "T197D38D6ABA48CA0BD94953314EE7CBF67336BC819F5297473295B72F1C3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644301855, "uuid": "cf4db4a4-1e77-4dd3-a4b4-66e0a6d7a5c3", "value": "3072:lcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgPa3o:lcKoSsxzNDZLDZjlbR868O8KlVH3skeN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644301855, "uuid": "0773c403-9351-48c4-be91-9d7134c78e67", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644301855, "uuid": "934ca5c1-1128-4cf5-9677-8d81726e212c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644301855, "uuid": "70284d11-5846-4984-9910-d864a989bc77", "value": "tmp4779yqo9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df1b60a-88ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644330098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330098, "uuid": "478eed81-e78a-48e6-aaaf-86e78791a141", "comment": "Malware payload (Heodo)", "value": "df1f3bff9b5a710905ea8f6c303f7e53", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330098, "uuid": "a15b406a-37de-4a22-8b12-299e768284ca", "comment": "Malware payload (Heodo)", "value": "519a53832fda9de5e2b64483d6e7c1f9bb3919dd4d81b9f50cd76b4de9f34f26", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330098, "uuid": "6064683f-6665-48bd-a25b-5f437c829665", "comment": "Malware payload (Heodo)", "value": "86c6932f7d51762b813659701d7d08e86556f051", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644330098, "uuid": "fe5e6aaa-d2a0-4bf5-99b6-5c956cee844c", "comment": "Malware payload (Heodo)", "value": "f6a3ff1d1e3dd9e3b0373962900c0cba32ed91a2368c9e9219ed853040c58a3fd5762270680276d9155dfc343874416d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330098, "uuid": "b993629c-d10c-4a8c-9228-9f37a2f78a23", "value": "T14A848D06E652C03CFEFB04B8D496CA66ED5E3A24169D619F63413A6D32613CF123F52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330098, "uuid": "a6ab59d3-fe31-4471-a1f7-1d018cd7fbe8", "value": "79fb40281049052b3e354a6e444da473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330098, "uuid": "9ffef05f-b84d-49c3-93fc-fbfd3b177e28", "value": "6144:O56dLjBFLyztOo/eYIjAmkB8lebi9JqGXdZ32mneM0laNUIbeURK46:YszuzNKjWB8f9JqQ2mnB0l4UMK46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644330098, "uuid": "d044490b-4657-4be6-a935-fb5a9af624b6", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644330098, "uuid": "ff9df76d-d806-4ce8-b29c-616d5db65f14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644330098, "uuid": "71262e0e-0a58-4e95-9bb2-38853dcf3e9a", "value": "emotet_exe_e4_519a53832fda9de5e2b64483d6e7c1f9bb3919dd4d81b9f50cd76b4de9f34f26_2022-02-08__142126.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01e6504-88d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644321646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644321646, "uuid": "e62412ba-7911-4443-9c6f-690df295ae20", "comment": "Malware payload (Heodo)", "value": "1be44be3d8cef00ebeb7a44fcf015f7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "expor