{ "Event": { "published": true, "date": "2021-12-07", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-12-07", "timestamp": 1638921781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "42ea3008-e329-4db6-abc2-31ebb8077088", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f249eb6-575c-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638881505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881505, "uuid": "4f62ea0f-39db-48ac-a8aa-efe7886da038", "comment": "Malware payload (RedLineStealer)", "value": "0cefed061e2a2241ecd302d7790a2f80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881505, "uuid": "845f8c23-3295-4dca-b953-77c631696543", "comment": "Malware payload (RedLineStealer)", "value": "014ad60fd2c294dd8fb63c022961e17df1ba74bb1209a64634112913edc44983", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881505, "uuid": "cd51d074-f3f8-4abc-92bd-9fd57137cfaf", "comment": "Malware payload (RedLineStealer)", "value": "5f119195af2db118c5fbac21634bea00f5d5b8da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881505, "uuid": "154709ad-5b00-4d03-9e0e-0fa8fcdd6a51", "comment": "Malware payload (RedLineStealer)", "value": "123229b5bffd2c14ab44fd97365b59c25df5f3cf4a42967b0d5ecaca9ef530c1b86b2a6f199ab674a5e410a1e493de3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881505, "uuid": "d57728d1-b910-4b17-bfbe-ad5a31a94f29", "value": "T188C41291A919DCF2FE320071CD216D228189FD985BFC8535B4ABF56EA17329334E371A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881505, "uuid": "9193bc5d-a0f2-41ef-b074-d9ac43b99551", "value": "899dc85694bff83ce383484013728aa1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881505, "uuid": "b4a03e50-6197-4773-9f86-46778c37ab94", "value": "12288:HGaq4U/zgDMz01Uk/E8/41gZjv9rc3XYwMjVEd8KdRK:HGaqr/UDc8n/N/4gnrgkJsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881505, "uuid": "db4cf531-17cc-4501-bdf4-3e79ed06041f", "value": 561536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881505, "uuid": "0713f7f2-cbf1-4ca4-9e63-68a13b86cca2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881505, "uuid": "e8d30e2c-5903-4f0e-8d8d-1d2588123bae", "value": "0cefed061e2a2241ecd302d7790a2f80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a6b10db-5744-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638871162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638871162, "uuid": "4bd0f325-982d-4065-89fc-a45626016d5b", "comment": "Malware payload (Formbook)", "value": "d152bf2b775706780df89340500fb32e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638871162, "uuid": "1bd9b4b0-a723-46a9-9449-65a29ab76156", "comment": "Malware payload (Formbook)", "value": "016995a4b65533b314b70ebab42fb3c6dee830dff7a7261080f6e743da562b9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638871162, "uuid": "cc348a7d-015b-45fa-9417-9a3025dde07c", "comment": "Malware payload (Formbook)", "value": "87ded199c4610ea506c28f9b242f4cfb9d2a3a76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638871162, "uuid": "8346e7f9-74e2-4b21-a30e-4a636181b2f0", "comment": "Malware payload (Formbook)", "value": "014d6fd1f6c3a9d309f3d211ab23c3572542dcdf330835e96c907cd17b198d0f1127fe6c9aa37a10ea017033b3c099d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638871162, "uuid": "ab8ad05d-9f29-40f7-ad41-b44a9cd114f7", "value": "T14425AF15B250E833C23752B98C6BF7E855297F216F18EC863AEA6D0D4EF8650BC05397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638871162, "uuid": "309e0af9-ed4c-42fb-bf79-c211513665be", "value": "c994513c4cf2244ab09c2ce0f6794e8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638871162, "uuid": "043ec4a7-39a1-4901-99f7-74e9a85a5876", "value": "12288:dl9MEv3h5SuZicJohUytz1zAHDHxRDetor04cUAVzQ6rW4sIy7NdFRcqz:naEZ5SuZicyXtz1QDH/DeZhvrlW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638871162, "uuid": "5da9f97b-5830-498b-878b-69323a5240fb", "value": 1044480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638871162, "uuid": "75cc1b76-9ad4-4b27-b33a-5939384822ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638871162, "uuid": "807a7868-48d6-4244-9aa9-aec170ddda91", "value": "PI20962751514151615.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6548d65-5751-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638876927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876927, "uuid": "59a50671-dc27-4847-a994-9ea7256810d0", "comment": "Malware payload (Formbook)", "value": "99030ce68791e3f8781ff46852158857", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876927, "uuid": "b46fdfd4-e54b-451c-8edf-4aa3fccb6336", "comment": "Malware payload (Formbook)", "value": "01fa747b8b32419ca55b25f65aefc76cae767f454cf82b969e92636aff5291ef", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876927, "uuid": "ce6409f2-1712-4aa3-ba16-858857760c40", "comment": "Malware payload (Formbook)", "value": "aefb98f07176b4af4cddbd99b7d1ddc791ffd5f8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876927, "uuid": "0fc845b7-7116-479a-898b-e17b259b664b", "comment": "Malware payload (Formbook)", "value": "0788e7246e4a1c9ecd51a9ce0fbe7167b9aebc443568a21e637d732423059bf50dd0e76fbbf708a59e41612da8ef8e2a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876927, "uuid": "c3e87cfb-0bfb-4b46-a227-2b0f85189c93", "value": "T1BC34126BB109E3A6FCC8AA776558C3C5C0AEEC0DD721F8C72894323D95FE900AD72459", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876927, "uuid": "2760274e-e16e-4874-b819-739a52e1072f", "value": "6144:sHq9QvmbuLJQSK508jFuTDDhiyBVZnj7L9hpUn/:uqipK58dieNj2n/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638876927, "uuid": "17115319-1440-420e-9385-512eb78f2ed6", "value": 234472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638876927, "uuid": "c2c1f21c-a59d-41ca-9972-250b37d9cca3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876927, "uuid": "c7cc0380-596c-431c-b566-325370a08112", "value": "8009.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e43247-578a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1638901402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901402, "uuid": "130f2d4d-8fea-4ed3-8042-9fe8ddf8a690", "comment": "Malware payload (Quakbot)", "value": "f4ea14dc8f33171268b04157c7de9453", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901402, "uuid": "3cb20dab-c4e1-4972-88e2-2b3d60b46653", "comment": "Malware payload (Quakbot)", "value": "02d00daf7be47e4b9ead215b312eb8e02569f3392ed548f60d83fa0cb0f3caeb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901402, "uuid": "ff4fc0be-57bb-4d6b-b12b-2ea9b61504f9", "comment": "Malware payload (Quakbot)", "value": "df23cee95e6d9a9776dc8f192582e6cc184e95f3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901402, "uuid": "810e0815-9611-4866-aa97-300067d9de2b", "comment": "Malware payload (Quakbot)", "value": "fcde1c448195be7b7b6a9bb24ac4250cac4122f39f769a0679eb613fc574ef9371bd83d7b56488326c2ab01c5df3727f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901402, "uuid": "d3b2f2d6-6eb1-4b35-b9c1-991851b2e747", "value": "T162C49F76F6D08837D13325389C5B6368A835BE503D2858856BF81D8C6FB93813E7729B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901402, "uuid": "28297709-fd38-454b-9811-92efdde4d348", "value": "c87b0244d3ec3baa302e51fc063cf2a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901402, "uuid": "0ca5b582-0b8e-4e6d-b9b2-52a80798667e", "value": "12288:PWXcaMsRJed93y4JPIkFdHl1L8G394a2hNmQ8DgrCrhxEhL:PkrMwi37Tp1Im5zZgryhxEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638901402, "uuid": "dde549b5-fa69-458b-b955-10f008ec2ce3", "value": 596896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638901402, "uuid": "7db6d329-0d6c-4fe6-bcd6-01498739afd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901402, "uuid": "a7132c2e-211c-462f-80a0-2b78ffe15b91", "value": "02d00daf7be47e4b9ead215b312eb8e02569f3392ed548f60d83fa0cb0f3caeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66179707-5740-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638869464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869464, "uuid": "ca2f060e-96b5-4caa-b759-368fb14ad4fe", "comment": "Malware payload (Dridex)", "value": "fb01344980b58ecb3e0374df47688fc8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869464, "uuid": "cd7546ae-c5ba-4f19-88f7-820540f36337", "comment": "Malware payload (Dridex)", "value": "04341658994d17064801b9d675f01d415a01610b0ba6d6b04e604dd2dfd8e613", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869464, "uuid": "b12c6ebe-55dc-418c-af0d-c943d267b4b6", "comment": "Malware payload (Dridex)", "value": "5f23e7357657cf91634faa2fb8fd4c7c30cfcb09", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869464, "uuid": "8bc1ca51-706b-4eea-9e27-c51b15cc6329", "comment": "Malware payload (Dridex)", "value": "9f246ea24dc9fc33c393b1c8531ffa00f44251a072590b98417bbf912c69ace3602ac53548c8136b80ebcea993cfdbdc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869464, "uuid": "ff6bbf3a-1c21-4340-bccd-93f3e920c1e1", "value": "T1E2930189149AB8A0C5FD6EBD050D82F58901E516C52493CFFAEAF538D5E40FB43B0A6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869464, "uuid": "6caac086-0f77-408e-a81f-88ab62e3db5d", "value": "1536:lH5WwjpOtalpXW967T9WajSSZDD/PpKiYp+mZf3sbZYPTQk+X7+RUuYdbYwu/lnr:lHQ0XW967BW8NDpy3f3sdMT/+XCR68Hh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638869464, "uuid": "00138544-c551-4c4d-a8dc-b8a4d0475692", "value": 92591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638869464, "uuid": "5e9e16c0-0a7b-46c3-ab0d-50f37e8769d8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869464, "uuid": "b4b979c3-087d-42de-a3a5-be90ea41b9cd", "value": "INV93336082546.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b2e5d6-5759-11ec-96a4-42010a9c0029", "comment": "Malware payload (HawkEye)", "timestamp": 1638880204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880204, "uuid": "cae284bf-da23-422c-95a3-e90abe37a2d8", "comment": "Malware payload (HawkEye)", "value": "32eb10c12a29b38f13730cd1f5dcad4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880204, "uuid": "a5d4d7de-04fb-48e2-acc5-b6b4bdb45baa", "comment": "Malware payload (HawkEye)", "value": "06550442678fb92b0273b83f349d47d3654fb72a7d98398ce3b63e3635b8e8f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880204, "uuid": "ad9598e7-42c1-478c-801a-9712faeb5a34", "comment": "Malware payload (HawkEye)", "value": "4d0eb488a01fed1720483dfa270423bea593ca14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880204, "uuid": "e0461ff8-a4c5-43d6-868c-f1139879fb80", "comment": "Malware payload (HawkEye)", "value": "4aa332c8a92747d74120a45f3fc39fd0c1100341b8dd71efb82b78e8bbdfc370acd68979198f7a61fbdf069f473cae64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880204, "uuid": "176c914a-5a2d-46a5-9bab-e23d8604a0db", "value": "T1DCB501997F4273DBC4A87430CE16E966836E2E94D3D285B2A2E03EAF7475F738503161", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880204, "uuid": "5a7c5932-f6fc-43a6-838e-74fd99f6ec1f", "value": "be63889866f6bba2109402ee273e5652", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880204, "uuid": "e72b1b1f-ec31-4d12-bb41-111e1d075149", "value": "49152:AW3dW0e3O2oWFaLcZig+bnDPXqWtex9vtVl:AW3dWJloWFaLcZig+j2WcxLVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638880204, "uuid": "d36cc06f-662f-4131-b2d8-5333c6c454b9", "value": 2351104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638880204, "uuid": "a73a6da6-c9d9-46ec-9e0c-90fca0d68224", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880204, "uuid": "309a0038-acd7-4f1c-8daf-f10f75231d2f", "value": "32eb10c12a29b38f13730cd1f5dcad4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d8050ce-572d-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638861316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638861316, "uuid": "946b2df8-6803-47bd-be5e-7c72e5a9fa6c", "comment": "Malware payload", "value": "e4b1e99ab3896441735f1d53f7d1d1f2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638861316, "uuid": "16409c6f-7d62-441a-a062-b54a45e21aa5", "comment": "Malware payload", "value": "076cee4eb5629bd343656dbf7d70fb415589b369889aa18a894a54363b5b7b6d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638861316, "uuid": "538e969c-0f82-451a-aace-88d6a5b85f5d", "comment": "Malware payload", "value": "6db0d1ddca5c95b204c84c7cd2800d0708be6302", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638861316, "uuid": "afd3c914-1a3e-4c61-ae41-fc25bba33bac", "comment": "Malware payload", "value": "fa26cf1abf6fca23af24bf5acce85490b073595d0886e71f554c02f704eea846ff01ddde5ff36c248d288d98541e9dbc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638861316, "uuid": "63a9a610-3817-4475-aa60-94ba861d8bce", "value": "T17CF47D40F781F132E5AB00F686F7865AA67CB73057754ACF16C81AE9AB251D07D32B0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638861316, "uuid": "559405e8-568c-4671-959f-a02823b6e5de", "value": "12288:WKEUkuj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/U:TEe4GbOX399Md9J/0T2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638861316, "uuid": "49705cf6-14fc-4b27-abd6-57b5671b4dc1", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638861316, "uuid": "a29014a0-188a-4551-bf3e-12f1c3835baa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638861316, "uuid": "6116d759-35a8-48e3-a586-299c3e8c28e9", "value": "emotet_exe_e5_0f12ff194b2ac14849916494da53dc539bc7393b1cb68827c7f721dde390866d_2021-12-07__071510.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ea76a9-5799-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638907716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907716, "uuid": "419373da-a835-442d-b04c-a638562f958e", "comment": "Malware payload", "value": "0a13eac71fa2a9a0e0f4dd31651dbebe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907716, "uuid": "88c39ea2-d6af-47f4-bc68-5008d5eaf09d", "comment": "Malware payload", "value": "082ccf45adc44ae42f4e99f9207e56ea867f25b5dce2c30af3ddb7abf72f8f4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907716, "uuid": "8f098bcb-9d33-4449-a8f5-1f4e7e5ba2eb", "comment": "Malware payload", "value": "c0c3f8556cd9967ef0c28b47ad00f64cb9fbd718", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907716, "uuid": "d38dd250-d8d5-40cb-a499-ce817cac7e24", "comment": "Malware payload", "value": "6d36ac0a4d6844ee4c8c9d74d77af03abba745d7913523ecf9563f5c04811d7447e3e3d95f0742863163caddb4970295", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907716, "uuid": "d5df5f3a-a16e-4a1b-88c5-6cd5089ad2b1", "value": "T1A294BF10A7E0D034F1F316F85AB6A368A93F7AA16B3450DF13D526EA16749E1EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907716, "uuid": "d74a6771-12d3-4f5c-8251-1c3ef9882822", "value": "b5d39f822cf46cb1cac0e9a27db40014", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907716, "uuid": "e39cb380-79e9-414f-afde-4109b6756369", "value": "12288:WDpNVfYbGo2UO5ZsfAqTKE+SnSW/YUgvp:UfYRF6u9f9YUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638907716, "uuid": "8e261da2-08cb-4f71-bbeb-1a61f2164a54", "value": 432128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638907716, "uuid": "839b9fa4-004c-4ac7-8c24-3db70b289e8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907716, "uuid": "c71c3741-db40-404b-a855-04e548818257", "value": "0a13eac71fa2a9a0e0f4dd31651dbebe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "890b8983-56f1-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638835592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835592, "uuid": "17d16f44-67a9-4ffc-aa26-4d7935919700", "comment": "Malware payload (Heodo)", "value": "b39fb07219b1265b93422ae4aa554198", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835592, "uuid": "bf4d180b-5636-4c05-b591-02eeff1f7679", "comment": "Malware payload (Heodo)", "value": "08de4c194047170179f662047c188c222367a7b2e6a5ee1e49b94ab52e9b5377", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835592, "uuid": "d88afd11-ecb4-4fe1-9df2-d3777aec47d5", "comment": "Malware payload (Heodo)", "value": "4a1e7ee502f48af0575f9600c27125d0ccf2268c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835592, "uuid": "204265ae-b860-48b4-9f12-dd16db528d7b", "comment": "Malware payload (Heodo)", "value": "47a0f40177096584797fb2d0018317976950458407a90386bbe754eea44d78d559501e05c207e18ceba4096849c8c032", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835592, "uuid": "f9dce796-1581-40e1-bea4-1b37283aaba8", "value": "T1C1F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835592, "uuid": "8ecb05f0-7733-4985-847e-2d40c1085458", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835592, "uuid": "90a5188a-1400-4747-960d-88fd60a00a39", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/r:JapiKiBEmj4GbOX399Md9J/0TF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638835592, "uuid": "7bf4aae6-b27a-48a6-a4ab-ff058fde2e3c", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638835592, "uuid": "445288cc-09c3-41c3-bffd-085007b8fa8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835592, "uuid": "f9a431d7-e51e-4cab-b352-d124b5ef9313", "value": "emotet_exe_e5_08de4c194047170179f662047c188c222367a7b2e6a5ee1e49b94ab52e9b5377_2021-12-07__000627.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a87d32-578a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1638901187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901187, "uuid": "ace2b1c1-af82-4148-9bc1-c1b935889a8e", "comment": "Malware payload (Gafgyt)", "value": "2232fe0a6581f9dccc2840f47e8f7596", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901187, "uuid": "a966c00c-06b3-4651-b28f-993c4ceedb68", "comment": "Malware payload (Gafgyt)", "value": "08ecd6e5d744f4440ed2234f6f0fdcac6c7b2d1ba2e2407c302e969c1eb001a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901187, "uuid": "74cf8eac-a91e-49c6-9477-ab01ab04dfb1", "comment": "Malware payload (Gafgyt)", "value": "ec1094e1a59584b731155024d73e2c10da336553", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901187, "uuid": "8e516c10-7c19-44af-8c90-cea0886dae03", "comment": "Malware payload (Gafgyt)", "value": "c6868c57686458d149a69c468a0f0f9c633c4e0af7ea070085dd3ef4a22496a2e1e9bdca182f75624606ec306531a924", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901187, "uuid": "686f2f6d-2717-4cd8-8174-cc66037d1bb5", "value": "T1C09318B81995F77CEEF15079E84310DA28610A1837ACD1E379C3647AFFB47087269E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901187, "uuid": "210c9d89-410d-49b5-adf2-924be2cc5901", "value": "1536:VQHPNhpOTtsHT/WUXHaCw9iqLgaRW9uVtqN/W1ZBZCrHbe:2H1hpOuHTd6CwwiY9ueN/WhZ6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638901187, "uuid": "565a73d4-7482-4144-916a-fe31de4c8468", "value": 91588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638901187, "uuid": "e89249dd-80ea-45d2-a310-22f14b3af4d8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901187, "uuid": "a96f6c2b-9b9e-4df0-8f8a-1b218fa52805", "value": "2232fe0a6581f9dccc2840f47e8f7596", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce68b269-5782-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638897986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638897986, "uuid": "02769fc5-c5af-41e8-a99c-4caa52e70193", "comment": "Malware payload (AgentTesla)", "value": "69bc58fc2b4b03b0eeaa52a2b2fa57a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638897986, "uuid": "02d990d4-cb96-47e5-8865-16b1d2e9b44e", "comment": "Malware payload (AgentTesla)", "value": "0974d2f5ff0dcf2ce40a1c624bc4c586baec6ba6367dbd782f862bcc18ad85c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638897986, "uuid": "b8c3440d-ef38-4513-b9cb-b89fbfea10ca", "comment": "Malware payload (AgentTesla)", "value": "1ff3c6fd95f77440fbeaad12915972a65dd62878", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638897986, "uuid": "dc05eca8-804e-4d0d-9682-2fb99f2959b1", "comment": "Malware payload (AgentTesla)", "value": "8ef6da5a36732f95cb3ca2f9e0d8122bc98aa1f2a8a17bca1efe3252d2d7b6d7305fa68ccdb50853ade5ae14d5322d29", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638897986, "uuid": "0c076736-6e2d-4b56-8ca3-f3bd06280f60", "value": "T10D35127C375366CDC0619636733B906816BA3D36A467C75EE88A324F4823B42B97335B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638897986, "uuid": "bbb35b3c-ff7b-418f-9768-774bda43ff70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638897986, "uuid": "2490e92b-e567-470c-9ea4-9cebc0227339", "value": "24576:NEWBcaZ/hhUNjizkHiKT63B0yJnJHRqlUpJDsH/oKqbG:CWuWh6NZCw63BtJJHRql+m/DqbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638897986, "uuid": "9f778d3b-5ad1-4239-831d-25a014835dc4", "value": 1113088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638897986, "uuid": "2f57a4c1-56a2-41c5-a531-aa3b7df7e6c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638897986, "uuid": "9dfec28f-9a0d-4cf3-9e5e-54e0e3493c9a", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "872a7177-5721-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638856205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856205, "uuid": "b730710c-78bd-4dc5-9314-d6ca13f1d81c", "comment": "Malware payload (Mirai)", "value": "ae688bd64afded8ef3bcb039eaf0406d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856205, "uuid": "edbfb18d-7528-47e6-a253-555ae2fb308c", "comment": "Malware payload (Mirai)", "value": "09dd558786a9a746784a7128b3b078f7d6983b53e1eb80684bbe52f825dbcef6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856205, "uuid": "31e63f82-1e87-43ee-b369-13fb6b3a0c96", "comment": "Malware payload (Mirai)", "value": "26aaf283e6f0b36399b54021e42ecc7a5fa32128", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856205, "uuid": "211a2830-7750-48c2-a74d-3ba9f39bba3d", "comment": "Malware payload (Mirai)", "value": "aece99bc909ec9013474e02efa59f5864eb7ac3278af4c69ce0e5a276b29d87cc68711f3cc694a07a0815663cac10e06", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856205, "uuid": "d2c543b3-e8c8-4f67-9192-30e7f6d53a1c", "value": "T13F3302B0986D9CBBB3A4CF3BFD1D21C1998473BDF398413929A4E021BEF255411B540E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856205, "uuid": "58c6e485-3287-4ff1-af39-d35abbd5e138", "value": "1536:OyxAbfjtOudnl4Kh3nk+b6phirrg2LTzC+40wrANLp:OyGXtldnVnk+GXivg2LTzCv06ANLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638856205, "uuid": "7ad3054f-c368-4d77-9676-227a629cac25", "value": 54972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638856205, "uuid": "539a60b8-1f61-4bd3-92b7-a6a99e57d7ae", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856205, "uuid": "836a8e78-e40b-4983-9574-a897eba55604", "value": "Tsunami.arm7-20211207-0550", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aed3539-573d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638868076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868076, "uuid": "effa04e4-d3f3-404e-bcdb-437eb8c78823", "comment": "Malware payload (Formbook)", "value": "c253838c7bbee048a3a034f7c57ee51e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868076, "uuid": "0113ffe2-19e8-4611-919a-916e3c5fa917", "comment": "Malware payload (Formbook)", "value": "0b3cf45f434beb73fa2df5cef7e5f61b2d0cb4fdb426e2053c888c8567085d4d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868076, "uuid": "5bd5d585-ce47-487b-b198-bba8fa9b9f2e", "comment": "Malware payload (Formbook)", "value": "fa19d373dd101b8307b8d641bb6c2b41dd2b2ff3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868076, "uuid": "e770d1a3-d7ef-464b-8958-f4194f4cb64b", "comment": "Malware payload (Formbook)", "value": "f62d09c02042c8576e2ceda4c22a95124f2f38030b94f8dc23f5384ef4067ccd2f4681b43c47f8db7ba4dc55e9f9a936", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638868076, "uuid": "90f34597-57c3-4cc7-ab5b-f3f9678c71eb", "value": "T10C353300103D6C88A9F5D2F9BBA0FF6E5BED56C0D2FDE191569FA2A3F4D14BC1280196", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638868076, "uuid": "ec02761f-5dea-43c8-af23-e3da2ee67075", "value": "24576:hj6xptnIXEHIuiIE+XfLaf+woWO2uzRFW1rZ0owtT9lj5E2H2I:hj6ZIURiQvM+9WXYRaZ7ET9M2H2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638868076, "uuid": "45c1cda7-e369-4c4b-8c34-58ba368773d2", "value": 1093346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638868076, "uuid": "cfef18f5-eb11-48a4-b32c-e53f7ffe37bb", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638868076, "uuid": "58d88ed7-cefd-4171-bc3d-0df2b02ade8f", "value": "slip-12-6.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f609bbf-570d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638847575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638847575, "uuid": "0745d94f-f8a7-4461-bbf3-a48863ee544f", "comment": "Malware payload (Loki)", "value": "1924a979e99c5ebcd367544b9c45423a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638847575, "uuid": "4ce1fd92-c102-4bce-8aa4-7e83e4aebdc7", "comment": "Malware payload (Loki)", "value": "0caa902c368a65916d2fadd10fa10e4d924af64f4e3c17732ceb7142f2b4ec7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638847575, "uuid": "607c6feb-ff43-4ae8-888e-0ae41ba9e19e", "comment": "Malware payload (Loki)", "value": "058cb4a49c5f45f2243fd04e2998beb83a198305", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638847575, "uuid": "aa131bcd-5709-44ce-b19f-57fe01351f75", "comment": "Malware payload (Loki)", "value": "110a37cfd026b3c8d72dc497726035e8de7738cbe81769292a07b8f7fb9b82d95000780f4d50d8ea1da6cdb0a6fba599", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638847575, "uuid": "a640a65a-0151-4e08-b38d-7cf322cdb704", "value": "T174A402663342D867EE56CE79043FCCE596713EBD88110A8AFE947BAC95720D6883FD01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638847575, "uuid": "9c48dced-1f80-4e24-819c-17240df19f58", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638847575, "uuid": "efecefd4-1546-40bd-bce3-b23e3d7230d3", "value": "6144:mGiFCPJhtfVSDd61BXpybI1/NVzOicUCBrJHkdmbVgK+9TyucD5SCTJ0g2NnyR5j:9haip3opvrVOmbVgPFhC4yk0smE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638847575, "uuid": "0dcec536-a2e3-418c-8b97-ffab4220fa80", "value": 484588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638847575, "uuid": "f3c8bc73-02c3-4920-ba8b-20e06b4cb686", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638847575, "uuid": "31c2ea51-aca8-437d-8fdc-ad6d126daec8", "value": "PO#1135 - \u88d5\u5049.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e075ff-5751-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638876787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876787, "uuid": "2f0a7c67-7833-40e5-81dc-233beae403da", "comment": "Malware payload (Formbook)", "value": "9eb663878d28c30d20e867815f589d7f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876787, "uuid": "252c7c11-24fd-4632-a53b-e751f573adf5", "comment": "Malware payload (Formbook)", "value": "0cf4c5d895bebfb7526de955e7b49ae676f6b98392476f7fc61f7655834b6603", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876787, "uuid": "c59d2485-24c8-4be1-9bde-60768c2c2c18", "comment": "Malware payload (Formbook)", "value": "2c65544025859daba20c810d61b0a84bda307c80", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876787, "uuid": "068a9c71-eaa7-4e3b-af4c-a614904e2338", "comment": "Malware payload (Formbook)", "value": "961f883d1d5d4770e7ad686ec54ba5be6cd019279d134c41e7c1115b750e80202854700641a61288b61f03e233d0f8cd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876787, "uuid": "359ddeeb-6a23-4a8e-8f56-47278487eeb3", "value": "T1A93412EFF3B91AA5CFD0C67C6A642D10B421CDA0C9D5A84D640E73EF6DB9907E460634", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876787, "uuid": "7a8ff1f5-4512-4858-8bb3-6f707f01b1f1", "value": "6144:npRs3US4wOscYhL+FPWgJ6Am4qJHg/iBx91QYlOOpsRc:pRzS4nscK+xWgMr3x91Qc3yc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638876787, "uuid": "3ca5ae21-c5b2-4d7b-be05-ae1c58f59a7e", "value": 234616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638876787, "uuid": "f91db64a-346f-41a2-8bb2-904fde0cb6ab", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876787, "uuid": "d151edba-cef9-4fb3-94ea-82e1ef2122c9", "value": "New Supplier Registration Form Mopcoms Turkey.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f880c044-575c-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638881735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881735, "uuid": "7628d715-df92-4139-81bd-0811f23877ca", "comment": "Malware payload (RedLineStealer)", "value": "d92f413e5c665884f3b45f4b6bfeb640", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881735, "uuid": "3c183819-1927-4fb7-8b59-029449f1cbfa", "comment": "Malware payload (RedLineStealer)", "value": "0d397ba8d82603972ec469c7f8f99688143597bab496a0686f6fef08b85e0b2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881735, "uuid": "ac688b31-bf5f-4621-af41-935d1e8a5db5", "comment": "Malware payload (RedLineStealer)", "value": "26910c896532597ab32f328e3f6f308d82aa68f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881735, "uuid": "e75a1a4e-6653-4fd0-93fd-1e3531b5cac7", "comment": "Malware payload (RedLineStealer)", "value": "07dda7e9a3a640299d9b6b8d05317bce6a5e80b359f163195fea827a8a1bef7b7d4cd92092c97fc142f61fe7f8d2cbeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881735, "uuid": "ce4901e0-e1a2-43b1-92dd-cdc351d0701f", "value": "T153A401577219E019CFC60FBB4AD9C8BCF630B89ED49E4E7532103B691E753925D0EA84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881735, "uuid": "ed21cb4b-6246-4768-949f-3b47af74d45a", "value": "6bf71effed9c318d9a5cd85df3c522bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881735, "uuid": "d846b0d1-4b11-4644-9a9e-8d57d8e075b4", "value": "6144:NWs7OPsZJOwPwelSLqUdjg20G+2TJbD23yMjaDZ3GYnK1xMYLUjO0+D44Jo:dOEfwI1liJbS3i330M8UoDJJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881735, "uuid": "62c782e2-c3d9-44b3-bb75-1bc107025836", "value": 478160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881735, "uuid": "d63eac02-56af-42fa-875b-600f3c5ff669", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881735, "uuid": "6d0bfb22-8c1a-4888-868d-4b7576878a6f", "value": "d92f413e5c665884f3b45f4b6bfeb640.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d046a5b5-5725-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638858046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638858046, "uuid": "f7a38bf1-f5ad-40dc-9694-320b4a5c08f9", "comment": "Malware payload (Formbook)", "value": "983b84c880bbf655b7b77c34674a8077", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638858046, "uuid": "586c31bf-c669-49e5-9a94-58b09dada575", "comment": "Malware payload (Formbook)", "value": "0dd242a9073c3db71d926d614d58a1d7dffeac250014663646758f8d84dd1acc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638858046, "uuid": "39e40c44-0662-46bb-8ed0-a6b6d862d10c", "comment": "Malware payload (Formbook)", "value": "6557e6d720e1079d9cb0322576f1b171a83814f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638858046, "uuid": "e6d81948-c83a-47db-9138-63f3b3fff8cb", "comment": "Malware payload (Formbook)", "value": "6ef266684611b246a4403d06b7d7c29decd69004adc686fbcb3edac3cae79093dd6068549e25932d2519125b05bc2d20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638858046, "uuid": "7ccb165e-656c-4ff2-ab82-9012a45c2d57", "value": "T17825230411BD9B36DCFD4BF91851A1020BB1BE26B641F70AEEC06CD83966BD48FC6657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638858046, "uuid": "9117addc-0d02-409d-bed5-c8599ac65a75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638858046, "uuid": "b4170af0-8405-42c5-bc19-bf1758097cf5", "value": "24576:sJ6i/KNXKwDdsQe1bRoX7O2JGTfcw5s5gamRtP7q5xuo+:e+5DitoU0FGaWtDq5xuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638858046, "uuid": "80613d72-b8e7-4dc8-9bdc-8e1fcefd995e", "value": 1015296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638858046, "uuid": "2214ce1a-97fe-4c49-9e8c-7edf581775ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638858046, "uuid": "e5b18bbb-4148-4467-952b-055463827076", "value": "Payment2021456789098.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f043903-5753-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638877478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877478, "uuid": "845a3f3e-d7fe-4376-9b54-b84a82af4a82", "comment": "Malware payload", "value": "df31a47935a456e4bbc13b1d2bbe74c5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877478, "uuid": "eca9d623-f624-49e2-a0d4-74d897453ac2", "comment": "Malware payload", "value": "0e241634f42d4145187fcf5d81ba9627d1921600e7f18bf18b7a018170ebe11b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877478, "uuid": "ee1e2efa-26bb-4079-ab2d-78040167457f", "comment": "Malware payload", "value": "6f0b892dc4dad32e325d6d1131a63ae60cdb7209", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877478, "uuid": "f21e9cb4-ad9c-4786-8b76-3d628e1b4b37", "comment": "Malware payload", "value": "226ce9ac224d5c2ee8b23a507c395e663f022cbd8eff6c13511a73639921bff9941c867c80dd5d66546f716d39198fb1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877478, "uuid": "319f40d7-b417-4961-b936-5cf7560d1897", "value": "T1DA351248A257FF3E179F87FC3E10579238885DA980DDE371CA8EF81A50A7A5908F94D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877478, "uuid": "3f9782a0-db2f-48f8-b920-687d6820d87a", "value": "24576:GSubRlEX6aaZCYnTmeRRb1fWg/LW4yt/emVyqAx7u6FD8:hubRg6a1YqkRb1TTGbs7u6FD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638877478, "uuid": "3bdd0e4a-26b4-4789-b3cc-de3c88039aca", "value": 1103918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638877478, "uuid": "9d663ff3-6917-41a6-8546-37043d7ccc33", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877478, "uuid": "f0367ebc-0e64-4e87-96d9-072bc6e228b4", "value": "Ofac_On_Hold_Compliance_dtd_012_07_2021_docx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e768ea-5758-11ec-96a4-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1638880020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880020, "uuid": "e57188ec-2470-45d3-b510-ebe827df2998", "comment": "Malware payload (TrickBot)", "value": "19960144c686dac775ed7bca893982b9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880020, "uuid": "6814c8bc-c560-4ca8-af85-2a8c18761d6d", "comment": "Malware payload (TrickBot)", "value": "0e7bb37239f9267b8d799bbf199af3c49dc2b28fd2aadcbaecbc0e2b3ca4eaaa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880020, "uuid": "eafed23d-2294-4bc5-bb3b-1f1356bcb36e", "comment": "Malware payload (TrickBot)", "value": "a9be471157552ca374a615dd99c0452234981a4c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880020, "uuid": "3fc4303a-07da-4fa0-9148-cc1569697766", "comment": "Malware payload (TrickBot)", "value": "bd1395ff656f9ca4fe51be272569d10de9770aa00658410a78d6a9d7d995ec37fbf5bc90d422c88854ca4a8fe6ca4acb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880020, "uuid": "6eb69cb9-c805-4eb5-aedd-eec1503c9393", "value": "T1AE8534041452E27CCA09FCBDC536B49250EF0AA48DA2EC0DED797F901EA16F9D56E6C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880020, "uuid": "29be71a2-5d08-48b0-b3d2-1107f60def8a", "value": "028cb2120eb61bdd8d53c72736111b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880020, "uuid": "a84b01a7-2492-4a76-83df-a538d63cf46f", "value": "1536:JPwo+LV1pDpmE/X9XMp2nJ+bNCcMk0RzESN9dFMPiT1ak:9sTDpmK9RJ+8RzBfFMPiT1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638880020, "uuid": "b7c8c2c9-3f90-43ae-becd-edbadf4bf271", "value": 1813504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638880020, "uuid": "88f7e15f-d3fb-4f29-a0d2-1eba9f5d9aa5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880020, "uuid": "5c5c02ca-744d-4314-842b-2863dc26798b", "value": "roben.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe099e23-57a4-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638912668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912668, "uuid": "5d5f0b93-ea2d-4584-a88f-9d8e8d6e5bda", "comment": "Malware payload", "value": "af1a95797963e51df6f8348883dd83e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912668, "uuid": "dcaa0ccd-84af-42c1-8946-a523f417eb65", "comment": "Malware payload", "value": "0e9d7dd7f56cf707f449e9c046499f2b0a4a953794af5e7a15d3a6d5971594ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912668, "uuid": "0e4ab227-10ee-49f4-8493-0caef8094c87", "comment": "Malware payload", "value": "ad7383cc8576ff1ba2652a755d7dd9b585d44f8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912668, "uuid": "41549024-a099-4568-9a95-e4502a88595e", "comment": "Malware payload", "value": "26aaa0bd2c1cf9f7f674bcd706d95e15e234d27ec0319874df7955069b6ffdebe56f173034226333d07d29386ec38e30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912668, "uuid": "53bee480-bfc2-4542-ada9-769f251c1cce", "value": "T103C5330914E2F7E0D2C8E97A5440BC7C83E9A948F55925988F3F893A13B1B7E375636C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912668, "uuid": "bd2846cc-8387-4ebe-8e1d-950fc86d1c24", "value": "42b27a080e9ee0252f310f33fbc7cafc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912668, "uuid": "547b0ee8-4e0b-4b32-b2c7-c91b10d0daf1", "value": "49152:goRkQCuW8gcPq1bexp7rXszaErSwZVm1XQG6LkD3cpRO0yAUu+s3b:g7Z0ps9HcXQarHoZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638912668, "uuid": "2993759b-862a-49af-bf16-dca027010f83", "value": 2630144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638912668, "uuid": "a7ab4a58-e6b7-4556-99e0-1951265e96d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912668, "uuid": "2b4d38f5-831a-4afd-9f97-ddafd7a1afe7", "value": "af1a95797963e51df6f8348883dd83e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b359f7-5749-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638873436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873436, "uuid": "c7c0440f-466c-45f9-8739-9b6eb4a4f62d", "comment": "Malware payload (Heodo)", "value": "8a21d454ade2192356e6d78d777ddb1e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873436, "uuid": "aa2f5508-25c2-4890-881a-b765d65cdb0f", "comment": "Malware payload (Heodo)", "value": "0ebad64dfbf014eedddfe3d4fd37fd7f6e8b40041c3ee600e6a2061e9aefa0e7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873436, "uuid": "917ccf93-8e88-4cdc-b4c7-453589659482", "comment": "Malware payload (Heodo)", "value": "b3d830fbdbdd72b416c68a8035e10c8bc64b9f73", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873436, "uuid": "58f2d634-5451-4370-8148-793924d0c21c", "comment": "Malware payload (Heodo)", "value": "28ffebddf102a70cc4c726c8a2a31bc9420f2640ad445879f95f292886c558af620a28b97a8169c052de83c4a405d010", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873436, "uuid": "5988f9d8-9124-489a-99cd-c3cb9f3b15f4", "value": "T1C7F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873436, "uuid": "619a9075-19ec-4fcd-a15d-05bb882785ed", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873436, "uuid": "7dbd4e0d-3c01-454e-bf25-595432e65c3c", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/r:JapiKiBEmj4GbOX399Md9J/0TR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638873436, "uuid": "cef5ffd1-31dc-4003-9521-0b6c857d2d03", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638873436, "uuid": "dde26b64-e363-404c-a42c-08be4c45cdb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873436, "uuid": "7898a40e-07a4-48ab-b7d6-6661c759951d", "value": "zVe4lhrdcsDx8N.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364674b5-5775-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638892147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892147, "uuid": "86560c38-bd95-4cf1-b7fb-27530fbd00ab", "comment": "Malware payload (Heodo)", "value": "bb8226e88550cb2f3b7274b6577f7d2f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892147, "uuid": "6b6da3b0-6fea-4733-b7dd-f62b841516e7", "comment": "Malware payload (Heodo)", "value": "0ee4be9798f6f68931e6410ee1ca1758f4dd8f52b3af1ff241bd5b8e1b1e675b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892147, "uuid": "360b2339-2515-48ba-8182-9757488eb652", "comment": "Malware payload (Heodo)", "value": "7bf0abfabed3f6a4bd5398617c9bfb374d2a7713", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892147, "uuid": "1dd9aab2-e553-4c70-a2e4-39fdb21c5bd7", "comment": "Malware payload (Heodo)", "value": "70eba4c45765038ca31ce441951c9641b2e8db13a623e45a39711f3b6573006eb4b60aefdab96418f9782345e1298247", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892147, "uuid": "f007f99f-f7cb-4dc0-884b-3c72c0cf9121", "value": "T10DF48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892147, "uuid": "3a6517e8-265a-4eb0-851b-3feaa1769854", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892147, "uuid": "5ed1c33e-7b7d-425a-b3e7-fabb3aa72027", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/j:JapiKiBEmj4GbOX399Md9J/0TV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638892147, "uuid": "0d4cae5f-3488-43b3-b0f8-0d0d204e915f", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638892147, "uuid": "bc0a807c-133a-4879-97eb-0f6988b14064", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892147, "uuid": "7bc07783-3dd8-4fbc-ba77-a4239385c774", "value": "RkHzTkZPcbxoSep4qi.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71542c07-575b-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638881079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881079, "uuid": "0dec7de1-2bf2-401b-8069-e994af9c123d", "comment": "Malware payload (AgentTesla)", "value": "3366219938b1042a9840c3330db3002c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881079, "uuid": "88223fbe-5cdd-4829-a2c9-5033898269a5", "comment": "Malware payload (AgentTesla)", "value": "0f3c70e427d01e986b62b574353b5ae3ffae3ed52dd5fa396beede2d825467fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881079, "uuid": "a1fe3e5a-5ce3-4b62-8977-7fe27f51c4af", "comment": "Malware payload (AgentTesla)", "value": "c63116c2750c2782ac088a602629b33c963bbaae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881079, "uuid": "0a6457d8-d8e3-4936-a16a-e1cb1fb91106", "comment": "Malware payload (AgentTesla)", "value": "967232991b8da492cb8282ddac4967f2b30af5d61466f4de2b72700269c5b6bc24b0f79c26d1003182895b1af55fe724", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881079, "uuid": "36cf5abb-a343-4d48-8c33-762e99601aba", "value": "T14575F20E1BE45E1ED52F37B87481032203B26297FEBAD3AD51D8E4E51E11BD2862735B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881079, "uuid": "3252ecaf-37be-4fe1-a9fe-a2ebc83bfd6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881079, "uuid": "184ce4d9-3162-4976-81dd-d5b45a18a10a", "value": "24576:fAzvrrKd9N/rHEcUAcqa2oONYRZr320nSlThuVQf0lOBce5Ock/N1RUUGG:YfrQ/4tNXL3z0lTQV7e5Ock/N/GG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881079, "uuid": "e8cd2304-ea94-4d71-85b0-e8e1bf9e2a2b", "value": 1663488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881079, "uuid": "ca60ef84-49bb-4198-b9b2-782b860ff464", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881079, "uuid": "d435575a-60d8-4dcb-9530-388ce905662f", "value": "3366219938b1042a9840c3330db3002c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0ff81b-56fd-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1638840748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638840748, "uuid": "3ba1c40f-b08d-4ff2-b99d-b5e0b7180627", "comment": "Malware payload (Vjw0rm)", "value": "324c008ca3575a7b40ebec55eb1e17ce", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638840748, "uuid": "c706ccb0-60a4-438f-ba5e-0f2130ae78d7", "comment": "Malware payload (Vjw0rm)", "value": "0fe9f33914e59398a946e711307b64ec4ed7bf13fdf466be1750a77602772007", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638840748, "uuid": "3a0cc759-2377-405b-a14e-f43bd9aadff7", "comment": "Malware payload (Vjw0rm)", "value": "8a6058d5da5ce7a45029eaff6fdc048eb22bccbc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638840748, "uuid": "2d668f75-67a9-443a-881b-134ba5ed7169", "comment": "Malware payload (Vjw0rm)", "value": "72aaa41cfa90794de5cc2db668fc8dd11f06903dee8faec3b70314adf8d860622f10f0606959661779d986b57c031c4d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638840748, "uuid": "585bac72-f74e-4cde-b743-4b80be8ecb39", "value": "T1BEA27DD8AC43EA86DA20A611B56F5CDCAFB80317C016129E385EBE840F72625D78DD3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638840748, "uuid": "1472cfcb-3cdc-43c4-a8c9-f6736ef6761d", "value": "384:tm3uw38fktU6qMbvmeG1/1SFjxg6Gikgx3tnS4hb0vy5r/bWSCnkUFlP4tXwGe:olssPL1hZxgG13xSeYvy4/FF4ty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638840748, "uuid": "d2e8f515-4acd-4be9-95b5-a1c9757bae17", "value": 23205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638840748, "uuid": "69421abf-f26e-49e8-829c-2361d321b325", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638840748, "uuid": "a6ba073d-49a7-44b3-a70d-911a081999ce", "value": "receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb45a50-575c-11ec-96a4-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1638881581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881581, "uuid": "9420f2cd-cdd1-4b51-aa4e-9d6ba7cb9c93", "comment": "Malware payload (TrickBot)", "value": "9ca16900f5e47678fe02d5caf0fd1bda", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "rob141", "colour": "#015534", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881581, "uuid": "0cf2c50e-e354-4dd8-b9ad-821dcd6f885a", "comment": "Malware payload (TrickBot)", "value": "0fef64eab9583e653f02f7fc28af21b9cc14265f8a6bbae518e2325d417994cd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "rob141", "colour": "#015534", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881581, "uuid": "7a0fe061-584f-4e8e-b2c4-69424f3d00ba", "comment": "Malware payload (TrickBot)", "value": "0e099b335bacf41555431c11530ceb46097f0ae8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "rob141", "colour": "#015534", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881581, "uuid": "0f9bc739-18d0-4674-a676-78e025363385", "comment": "Malware payload (TrickBot)", "value": "29b95eaae67eeb58da441bee751e425bfd5f6381c98eb2ef8cf29ad4fa45716b90290ece197c70b2052e9bcbbb6b33d4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "rob141", "colour": "#015534", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881581, "uuid": "71cfcb61-eb5c-4212-812e-d55dfcada9e1", "value": "T109B4B0F4A073D554FC1F26B6A5C128884AC73DEB3A1EDF4A0128B57F29754D83AA484F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881581, "uuid": "35dadb57-ed61-4950-8f63-32b2b3d1e1ab", "value": "3072:AE1bLoyHKRH01H+N6NODxksdh31wLhrQ37Glka:A4/pHoHyeN6NQph31JGlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881581, "uuid": "ceafbbfe-744f-4e54-aa5a-2dcd271c0c04", "value": 513024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881581, "uuid": "cc7413f2-4e44-4d6c-8c45-00e1b8f361b4", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881581, "uuid": "c2505761-d2a6-48dd-8dbe-b1bd52fd7e3e", "value": "1cam.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b07837a9-575c-11ec-96a4-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1638881615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881615, "uuid": "3ba79436-82eb-44dc-8b22-404216aa2701", "comment": "Malware payload (TrickBot)", "value": "41284ac274fbf87258a25ddb1ebcdaaf", "object_relation": "md5", "Tag": [ { "name": "blob", "colour": "#461C31", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob141", "colour": "#015534", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881615, "uuid": "f6c1248c-b39b-458c-9b0c-e9f8407fe9be", "comment": "Malware payload (TrickBot)", "value": "11a97ea5de61a5c7302bb82c4fd6b149d5f2db5d8157e73773a447b477a9e075", "object_relation": "sha256", "Tag": [ { "name": "blob", "colour": "#461C31", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob141", "colour": "#015534", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881615, "uuid": "2f9bc058-8c2f-45fd-ae7f-f0c3475624c9", "comment": "Malware payload (TrickBot)", "value": "244b5949e064d50e3a74453d745ab60d816c4d92", "object_relation": "sha1", "Tag": [ { "name": "blob", "colour": "#461C31", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob141", "colour": "#015534", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881615, "uuid": "ab6d29cd-da95-4bb6-8fc9-d3eaa70d1315", "comment": "Malware payload (TrickBot)", "value": "b1e0b707e63a0d5f677e793c3fc8fa62ab1ba0c5b978e5ce6e7551a3be35e4bcbd8a9a224974c0691e934ab0876e481d", "object_relation": "sha3-384", "Tag": [ { "name": "blob", "colour": "#461C31", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob141", "colour": "#015534", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881615, "uuid": "01d4fb8b-9a37-4514-8f95-06c66539563f", "value": "T132852341F513F1099D28CEBE3D62BCC8BC954CA6E872423D4FBA133990B667A259D077", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881615, "uuid": "2944db20-49c0-4eb1-bf69-9220bf285652", "value": "41ff3531397ff529a9903a3f9352fbb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881615, "uuid": "b989b1f4-7733-4ddd-b6fe-0d4cb092896f", "value": "1536:bHsZePiJlBAOF7aOds8hZ9HM6ZQZC1bxBdsvg8+jdLW2cnDC525qAFdhz3mnpkV9:IgGxF+r8j9nmU1/da", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881615, "uuid": "4c55ad9e-f794-4079-a7e9-675452c354a7", "value": 1784832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881615, "uuid": "0c4effde-2bbe-47b6-92cc-485c782c17b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881615, "uuid": "3cacc2f3-35a1-4b85-9460-f45d73c862d9", "value": "2.blob", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e1a3be-578a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638901211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901211, "uuid": "c202670c-e900-467b-9a63-1ce8752991fa", "comment": "Malware payload (Mirai)", "value": "7773db80dc823a49481d97cba204bdfd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901211, "uuid": "c8c33eca-3c72-4381-861c-4adf1c53c4e8", "comment": "Malware payload (Mirai)", "value": "1260d1660dedbf659247329b59e4254863ed5468fe8b51139be70921f07f0d64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901211, "uuid": "9cde680f-88e6-4dba-b6ad-df85d5b816af", "comment": "Malware payload (Mirai)", "value": "4ae8b441328d7eb205094801efc527b01ec502fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901211, "uuid": "09ce0f20-8c30-415d-a952-d5ecc1da3ad6", "comment": "Malware payload (Mirai)", "value": "f4469256d2108f279cc953becd01a1b056a70f107cb61f22120014bebb56535c1b441baa84f559373c9a877225d32865", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901211, "uuid": "af86f9c6-7460-47f6-b274-1803f7143e97", "value": "T13233F885BCD29A1AC6E0537AF96E809E331073E9C2DF7623CC140B1176C655F4EA3B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901211, "uuid": "f38b6bec-4802-4cb3-8898-bf309fb79642", "value": "1536:RfinNXlMJZdy9imMnjkYm7JSWOCrcO+1gAD2yKCQ5KkzoEOSSSSSSSSSSSSSSSSc:RqnNXiJn9j2yBezohSSSSSSSSSSSSSSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638901211, "uuid": "c871a929-8a00-485c-9b95-85000d3a3278", "value": 51392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638901211, "uuid": "f054a5f0-74a4-43d3-bc38-6ff6b7eb1f14", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901211, "uuid": "707fb099-2a66-49da-a651-eb7797316486", "value": "7773db80dc823a49481d97cba204bdfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b25ca5-577c-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638895251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638895251, "uuid": "2b011019-2052-4f4b-883d-476e2102b487", "comment": "Malware payload", "value": "ad7065574f3c3a0bd003b6288453288c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638895251, "uuid": "be2125e2-6864-44e3-9dcf-f3cb05b025c0", "comment": "Malware payload", "value": "126f7b06e5487db94b1dc03209b4eb745ae3e3f5946282b57e4b6112d2d141a0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638895251, "uuid": "7cec574e-7a60-4652-940f-b79781ac8a53", "comment": "Malware payload", "value": "3aba5535acbac5e7ff505a9f1a6c92646c2fb600", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638895251, "uuid": "48dc99f8-90bb-40e6-9d59-43ba30978f04", "comment": "Malware payload", "value": "d3bf0b95780b1f25770bf221144e3a9c1480cff6dcb0f599b6879e3b6025faa211f70e806c5308e45ea5d2a59b755795", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638895251, "uuid": "442297a4-c621-4c8c-9dfe-172ce55bba35", "value": "T1A7449D442D12E0ACF4472536206A6931CFC4AB038FB5C8D3DE65E612DC6DCCB97BA6E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638895251, "uuid": "443e4e81-f72e-4f0b-97aa-75c808d55495", "value": "6144:avb/erFY5g4ZDYzZkPwkRVY8HJ/LxeDNtdsGS28Ps3RgiNRf:a/eZY5g4luZowGJ/LwRMGS9sBg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638895251, "uuid": "ae85050e-a446-4c1b-ad7b-dee0a26a213d", "value": 270246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638895251, "uuid": "9da311c5-4fcf-45b7-a321-c3b10b9f41f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638895251, "uuid": "45ad6ef6-3afd-4aeb-a251-7bd94800b799", "value": "emotet_exe_e5_126f7b06e5487db94b1dc03209b4eb745ae3e3f5946282b57e4b6112d2d141a0_2021-12-07__164047.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2220644-5789-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638901025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901025, "uuid": "444c0cb6-12dc-4325-bd59-391b56f51342", "comment": "Malware payload (Heodo)", "value": "62e1c3e3d8cc10ed2cec54a2eb3632b4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901025, "uuid": "52159542-97e8-4af7-9b49-fd584f31ea9d", "comment": "Malware payload (Heodo)", "value": "128a75fb708af1dc703c5f244132eb485256572bdbbc94848054943134aa06e6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901025, "uuid": "554106a2-55f3-44ec-a273-d0f2e3ea8dea", "comment": "Malware payload (Heodo)", "value": "174644b9f6b2f86ac48ad66ce097895116189726", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901025, "uuid": "d300796b-5a55-4b03-9108-64c7b1291e6f", "comment": "Malware payload (Heodo)", "value": "e22890f36fe1bf894a61ff150a7719bcc0408b2d0a24aeea5dff8d9d790780c9f5072edad906d7e7457bb24daf7d7d04", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901025, "uuid": "c9f8e5ac-d418-43ef-8135-abdf18e72a03", "value": "T1FB55CF043D8180B6F92724391238B7658FEC69210B30C9DBEB94ED7D5E25DE25A3E1DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901025, "uuid": "51811519-90c1-49da-8696-7c8656426155", "value": "ce5896fd181bed8a87ce7f299693cafa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901025, "uuid": "447a8816-18e9-42d0-8d3b-7eacd618c7df", "value": "24576:a/eZY5g4b9/LwRMGS9sBS0EPG9RIOyp+PB9b12mehjfhfyxI+tORocluvCqknhWK:Nihwm98f9RvPXehKI+t6zri17oN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638901025, "uuid": "ace67aa1-137f-4f00-92a0-b59fab185abf", "value": 1355776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638901025, "uuid": "c9d70f2a-5553-4e88-a34c-2857b400e029", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901025, "uuid": "41d2440b-f895-4d13-adc6-718183131606", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe2e375-5739-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638866581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866581, "uuid": "fada493e-cd3f-40ea-a8bf-737ef7501d3e", "comment": "Malware payload (Formbook)", "value": "8377eee01b4f9e63679649f33e365696", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866581, "uuid": "e6f4598f-ade3-4b74-b7e9-b49029071ae4", "comment": "Malware payload (Formbook)", "value": "137b4bbc65e949267f604b8a40ca88aa4c1d8498423590b0e6ff804f4b9a2ecf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866581, "uuid": "071a5733-5f2b-4e05-8f43-6f36186dd2a0", "comment": "Malware payload (Formbook)", "value": "5c8768862b6644f7ff864e7bee825ddbdbc93d21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866581, "uuid": "de4c74f5-449a-486c-a4b4-ad08436f4076", "comment": "Malware payload (Formbook)", "value": "aeab0386dfb0a2fdbb0b449b6aca4b320a6272ee34b65c0365a9424f92c7f80f337b1f18b7ebf18fe101709dfc806ed6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866581, "uuid": "2ab1e570-84f7-4c00-90cd-1114f6682396", "value": "T1DC45692D22B5086BE87D1A345421477B4EF26C3D997BE3CD3748356B0BB36840A267ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866581, "uuid": "a8ba59e3-1007-484a-9d14-95856eded116", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866581, "uuid": "90d3052d-5a11-4827-b828-b18d6bc1147c", "value": "24576:pOSawrgx/tgEGERIYQIJylRNClLRX3LJ:BzrEV/Ny3NM3LJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638866581, "uuid": "0ec9761c-5eca-45c2-b795-4a855bda91c4", "value": 1269760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638866581, "uuid": "2a4ced31-ee15-4ae3-9a29-fcdd47033f16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866581, "uuid": "4558ac96-3280-4172-af09-ae29f7104aec", "value": "THQT-ANOVA TRADE-QUEENA..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e161d930-5754-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638878261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878261, "uuid": "bd7dd18d-eaa6-468b-8234-ea5941722ee3", "comment": "Malware payload (Mirai)", "value": "f30dd9d36f8d0afdcc63e0d1ed454656", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878261, "uuid": "304b3fca-b465-44cf-842d-c1f94f7eabd1", "comment": "Malware payload (Mirai)", "value": "13a13597b4dcebcb8bc6441c8dbbec555eb4ee937f8ed0f93372d69842d1af20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878261, "uuid": "6c6dbf8a-5930-4bee-ac6b-81d16ab31c41", "comment": "Malware payload (Mirai)", "value": "7a4bdcbcabdef8959a887dc735a0c0113bd20531", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878261, "uuid": "df4355df-8795-4da9-9109-b020e6fc5515", "comment": "Malware payload (Mirai)", "value": "356b232918638705164396b3a1d6aed9b99b72afb5e20709e76a34e9963587eedc01b760f7748da89c034fb2b17a4216", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638878261, "uuid": "781957e7-50da-4295-910e-8eeda7510231", "value": "T1C7333AC5A743DEF1ED1206B13077EB338B76E47A212AF9C7E3D5A537A841A05920329D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638878261, "uuid": "17e5d2ff-a3cc-4add-a270-d3ace397839d", "value": "1536:s8OP6OftfvJfrJf0hJeVVMRHZW78syH8a+XYcPnYbjGGgvDx:hOfVxfrJfAJ2VY5nsyH8a+XRnYbaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638878261, "uuid": "fe37a293-a9c4-47e4-89b3-2dd5c89db974", "value": 54032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638878261, "uuid": "0d63ada1-8c2c-4b59-9387-270927e372ba", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638878261, "uuid": "9226ad91-d178-4bef-bbff-626dec2fdb0f", "value": "f30dd9d36f8d0afdcc63e0d1ed454656", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce2533f-579f-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638910358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638910358, "uuid": "88490853-b53e-4dd5-99e5-03b8cc359534", "comment": "Malware payload", "value": "d39fd3cc41bcc33345a9c1dcb86b96f4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638910358, "uuid": "41ab703a-5839-49c4-9e9f-3401015f3881", "comment": "Malware payload", "value": "14b2dab03e3aabf153444360bda568f4057929745ea69385c299442a749ab863", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638910358, "uuid": "49204ebf-9b9d-416c-82c5-aaa9645bcc00", "comment": "Malware payload", "value": "618558951266a027bc8cb01db62032a163509338", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638910358, "uuid": "650d4803-8b68-400c-9323-a5184787bedf", "comment": "Malware payload", "value": "34b2d980a6f0125c062d58408a942cdd832d7f467109f80c59c2ea634a98e4a10305474363b76d384583f1b50de7e181", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638910358, "uuid": "b978cfab-3cde-4b71-8fff-2756a0b14eb3", "value": "T174043F27A455622FF1F2B3626D477F0CCF2308C8F7572497BA3E94760B2A455AE4248E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638910358, "uuid": "3e7b75d9-2097-4928-9ea1-ad87055c0a06", "value": "3072:4uVRX9Nx6XoCX1RueAkqgP3cMTY65sgu9NMtHgwy/pWXh6dOszLktyklqxYF55IU:ZdfpWXEVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638910358, "uuid": "0ce3a53f-cca2-456b-ad69-c83bf6e8bd29", "value": 185197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638910358, "uuid": "4cd8e571-9283-4b70-b3cd-4d78e14669c7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638910358, "uuid": "f5c51cd0-c026-42e7-9a52-c2705480d0b0", "value": "14b2dab03e3aabf153444360bda568f4057929745ea69385c299442a749ab863.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "738b222b-575d-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638881942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881942, "uuid": "fd42d22b-f34a-4380-817a-ac965c8e3932", "comment": "Malware payload", "value": "7573d903073b3ca3d2bb0487b14afa17", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881942, "uuid": "d4c61912-9689-4545-ac6b-e8621a7b30fa", "comment": "Malware payload", "value": "171e2a8ddd6343da0d56fe517a73a592392455c059099b606a9dd9a1ca117cfe", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881942, "uuid": "7d27c47f-743d-4730-8584-ca3469639e20", "comment": "Malware payload", "value": "c24454df6e45a6789f512b4fd2df4631185b13b3", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881942, "uuid": "da5bd3f4-6e57-4824-b65c-32686f1b2bc6", "comment": "Malware payload", "value": "295de01af110a7bc275c7f86af44b59f82076c0ff05c03253b4657a81e1f3dc30733792dade9947a19863e0370d18016", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881942, "uuid": "cefc67b4-a294-45c5-b69a-14b3d279c4bd", "value": "T14B95333F04475F7DA36149B5B82EE9E9B86E312CFC1C85A31E6180543977F42EBCA099", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881942, "uuid": "aa523c0c-84d8-4140-aeb7-5bc2f9f73586", "value": "49152:lttzQKc72Bw5G3PfrYzCB8JaPW4FTXkcafYAWbN+:5QLOPjYi8MPWs1po", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881942, "uuid": "1119dd48-9010-473f-9445-adcd9eb35dbc", "value": 2008436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881942, "uuid": "7421275b-e1cb-4d19-9e15-66f6f47e1657", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881942, "uuid": "d59af362-b568-4487-9618-f14bf163bda7", "value": "PO-13917890546653455345200915.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29329a8-5700-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638842212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638842212, "uuid": "1643c423-6592-4e91-9645-44b6f5a46926", "comment": "Malware payload (RedLineStealer)", "value": "3436a603bfcd7ff36a8935a2d6ffcc42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638842212, "uuid": "35949a4f-0dbe-46cf-8711-7796dda21031", "comment": "Malware payload (RedLineStealer)", "value": "17ca1538d136f4fce9b5719d233e94eca28dac49990e83fd90fc51a2abae9443", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638842212, "uuid": "65f61158-018e-46b5-96bc-0385aac5cee8", "comment": "Malware payload (RedLineStealer)", "value": "f919d75ed1f9504a2ac61b2c4ce1c12a30f3ef63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638842212, "uuid": "6f9b2a6a-4120-4342-8413-7d856a7696eb", "comment": "Malware payload (RedLineStealer)", "value": "68fd5702167864288b146f3f8c05a6be237433978c16e96b77b8181685aaa86b9504eee64087e5f068cefb462aad74f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638842212, "uuid": "b33bbb62-9f26-4f7b-8c7b-40c464f6053b", "value": "T16634AD1132C0C433D013647A85A5C7F24A7BB8755A66AA8BBFC81FBD4F257D1DB2930A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638842212, "uuid": "9a8fe985-66cf-4c08-8f80-e9af40abca56", "value": "3e040a184666b793e8b84904205dc569", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638842212, "uuid": "1fae938c-80eb-474f-86d9-1d5b5a81e30e", "value": "3072:m0+EVfJyWTaoMRAm6IZRHJiDCFuCXGqe7vh8FoOKEf4RFHgX5t81:j+EVfJyW23huC4hgF4vm81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638842212, "uuid": "a2d21af7-4bdc-40dd-9860-084cd12660ff", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638842212, "uuid": "d290e64f-6777-4f51-9ade-d2e33075660d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638842212, "uuid": "b283622c-dc24-4909-b787-63e721cc933d", "value": "3436a603bfcd7ff36a8935a2d6ffcc42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ca567b-5704-11ec-96a4-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1638843647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638843647, "uuid": "d2bee888-3fb3-44a9-961f-b5147df824c8", "comment": "Malware payload (Amadey)", "value": "bd0d9c788a9399ede42b878cc0e1583e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638843647, "uuid": "387d7274-1988-4b4d-ba3a-00427632677f", "comment": "Malware payload (Amadey)", "value": "18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638843647, "uuid": "009e725f-6929-4783-8f43-4ae83c1c8b2c", "comment": "Malware payload (Amadey)", "value": "ee78dbd9602863e63f4257f61bf46ab4ccd110fe", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638843647, "uuid": "8415928c-913b-49fb-9641-c5552b10e82d", "comment": "Malware payload (Amadey)", "value": "8786072d4cb45187185234e8ccb5fb92252749f5031090accb02cd909702cbca58abe633b64a55f26caacd3dbfc50e88", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638843647, "uuid": "7d82d4e3-81db-4234-a354-f20bd06e8d60", "value": "T10D648E10A7E0C435F5F712F84AB993B9B93E7AA16B7490CF52D116EA46346E0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638843647, "uuid": "e07d5352-1029-4846-8875-612b45c46251", "value": "9a4fc332982336bed32e6b1dc80be347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638843647, "uuid": "701113c4-0a9b-4654-8e9c-c1263a7a577a", "value": "6144:OBRu0NZOOPzac9Y40pz1m13aWZ6/XiIOW:OBR5Nlac9Y40pz813W/XiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638843647, "uuid": "83a32424-b214-4a3d-bfd7-9f5bd8824f0c", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638843647, "uuid": "cd4603ed-5334-4c80-870a-3f7bc42bb3bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638843647, "uuid": "96031bb0-f8b6-4cf8-88a2-37101b7b7cec", "value": "bd0d9c788a9399ede42b878cc0e1583e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418cbbb6-5767-11ec-96a4-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1638886153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638886153, "uuid": "26c27a83-7fb0-445b-94fe-137672d83143", "comment": "Malware payload (AveMariaRAT)", "value": "36831003460b60b8aa1af55db5ec6c7b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638886153, "uuid": "cba341f0-af65-405e-abad-13136595f98d", "comment": "Malware payload (AveMariaRAT)", "value": "1814342a47e6ea264ef34d80e36d9363a83d4a2d09a6eaf8fb2759f59697dd74", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638886153, "uuid": "fa42742b-306e-4ea4-97bb-7bf9800d3d6e", "comment": "Malware payload (AveMariaRAT)", "value": "7375eabd4c19200d12a4fbc084c3184af718c5f1", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638886153, "uuid": "59f350de-5b05-4f3f-b1df-ac01aeb8d08a", "comment": "Malware payload (AveMariaRAT)", "value": "0bcfd1d9150d6d4c00fdee4556e14f55808f504faa543f42fc42db4263235aa31a5a89314debb7e2e70a7e170d039ad0", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638886153, "uuid": "eeb1ecc8-c5d0-4b64-9f3a-6851868662c2", "value": "T15364126AF9D12C63D997177302727A38D2FF5EA4D2338B5FA709FE565232003B422A45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638886153, "uuid": "9ee70d22-66b2-481a-8a64-7ffb414c39f3", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638886153, "uuid": "06e31ea6-d5b8-4d12-93e3-0ae5563d9731", "value": "6144:jGiYYzJ08gGhiVwxTH+Xx2VFRzphz3KIF64xkEyLl48C7h5:hWSiVO+XMVFRzphTKm5+XLl+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638886153, "uuid": "1c52bd8b-514b-4c05-a298-4523a5c8002d", "value": 326570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638886153, "uuid": "6ecdf6b4-ee8e-4e0a-bf75-8c70c42725fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638886153, "uuid": "7d490400-f4b5-43e8-a45c-5b67a0829ef1", "value": "images0008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "573fef3d-575e-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638882324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882324, "uuid": "4cd4eb84-288a-4376-b75e-b23c6c173ea8", "comment": "Malware payload", "value": "e319d393821a0338522a385ff011334f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882324, "uuid": "a4dd31ac-ec03-4ebf-8501-2020decdc63e", "comment": "Malware payload", "value": "1853e10de6c3f05b3858b412f0684df5016f03f5f98f3071d8d0c88404d4225e", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882324, "uuid": "6ec6590e-154b-4a1d-8332-233a38cd625b", "comment": "Malware payload", "value": "e09174bfcedc3e0eff83d7f82e26436fbba18950", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882324, "uuid": "14cb8ade-4c45-4342-a600-cbc8961c7de7", "comment": "Malware payload", "value": "a1245101e6a26a970f8d085435ab8563faf929e7a352163fc6640ff800d4801489fd0efde39e6e1c3be2bd68ddbe1fc0", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882324, "uuid": "b5c783fa-751f-4978-8597-69acae777b1e", "value": "T1E903AE7C90FCFD542418C556EE40F92ABC252B3F897647EA7E027164A469CE04AE1FD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882324, "uuid": "a1493e6b-eeaa-48db-893b-d026f47349e2", "value": "768:KWaVspdlYV1ZMaLEt16AcyragAeE/zTsm0pB2A9zfC+gUbz:5aVs5e1ZxL8DXagAZLTsP3gUbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638882324, "uuid": "fe0a9a38-048e-4916-83e0-32b2ae689eb6", "value": 41041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638882324, "uuid": "8f436157-ccf6-4ecb-a2a0-f58a8c910ab1", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882324, "uuid": "ddf0fbf5-6d99-4712-ad6f-72d5fc7e747a", "value": "INV93610141.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd3ce67-5712-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1638849692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638849692, "uuid": "eb981c62-07af-4ba8-84d4-4e5fabf40aea", "comment": "Malware payload (RaccoonStealer)", "value": "341e8df98aa2e6212e2866aafafd573f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638849692, "uuid": "f96a1d88-b075-4ef7-bccd-8708b23f0aad", "comment": "Malware payload (RaccoonStealer)", "value": "192602e7e46bd1a921c2312cdf2f8bb2d571aac70c22b0546be3d45df7692ff7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638849692, "uuid": "8a556048-cbea-4aaf-be16-c66e2ccaed7b", "comment": "Malware payload (RaccoonStealer)", "value": "4199a4b1363f53a406116af39f0f562c195454d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638849692, "uuid": "055f0ea8-4e1b-4926-86f5-7c8f2ebfed49", "comment": "Malware payload (RaccoonStealer)", "value": "9b4179420890475b3182caef4c0361baecbae3dd79ce7f4a6c8d6b5fc760bbd8476dcb55f2a84e8ced4f7325040b773d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638849692, "uuid": "a3be2c90-dbca-4d73-9159-033fe139dc5b", "value": "T13E647D10ABE0C435F5F752F84ABA93A9B53E7AA16B3490CF12D516ED4634AE0EC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638849692, "uuid": "e814c2b1-96e1-4dba-b48b-08e5f3069408", "value": "9a4fc332982336bed32e6b1dc80be347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638849692, "uuid": "8605a9e4-5642-4d03-b987-b7a4c20a65a6", "value": "6144:l2Iq/E2CqgaHA6Nlql1mfwK9V2Fl0aPyIDM:l2zdCqgaHA6Nlql8fwlFl0aPDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638849692, "uuid": "f64b6b1b-68cb-4fa2-8c2a-de219ee50ff1", "value": 326144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638849692, "uuid": "87555c78-c68c-412d-8c4a-6c60670a16bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638849692, "uuid": "df050898-ae95-4288-9bce-6b1519fb8d37", "value": "341e8df98aa2e6212e2866aafafd573f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ec4c14-5751-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638876923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876923, "uuid": "362ba724-82b7-44ee-bbb0-a1dd0678635a", "comment": "Malware payload", "value": "c5d7d71c373b8611911983d626f3092a", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876923, "uuid": "99d51c73-6f4f-4f0e-b3b2-e60c1fc7d8ce", "comment": "Malware payload", "value": "19b64dc9c278ac114bfb76fa439dff83ea789267f392d6ea56c6c5a7e2385e32", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876923, "uuid": "aef6dbaa-6580-41ad-b73d-0fab30d996ed", "comment": "Malware payload", "value": "616907d4c747ffaa24f5cefd6fe37fb8e7ea675d", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876923, "uuid": "d8f6ea82-77cd-4abc-88eb-04ec50548556", "comment": "Malware payload", "value": "0100f2db2ca3b4a36d34f8524a7042eefc73bd76ce9e9bbdd074804a4d34ddf0ede6f9f8069aa49bf2afc875980be5ce", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876923, "uuid": "67daf9b7-753f-46e9-bd58-c43d396cd186", "value": "T18934124E734A9545D25D08FF2DC98AAC0786DC88E28C095FBB603EF82634D6649D66CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876923, "uuid": "6c338e8c-6686-41a2-9284-a9408e423440", "value": "3072:sJq0ZaJDZOxZZ/wFSZJbB9bx7wYKi3Meghir+VkUNivU8YTtoNSp:sJDZaNgxH/tZ3hx7wY+s+Vk+7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638876923, "uuid": "bd15b6d3-ccf3-4d49-87b6-da5324308c12", "value": 234888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638876923, "uuid": "7395740b-34f2-4b2a-9fe6-80d8ef4f6280", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876923, "uuid": "b85a4920-33b0-4214-aa37-ec74df3e9a72", "value": "Document2130779.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413386ed-5735-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638864678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864678, "uuid": "3b5efc98-a89e-4aa0-9059-1a66ea353804", "comment": "Malware payload (Heodo)", "value": "1e32dce395f8fe5f9c3e7d29eb4a268a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864678, "uuid": "a2afdc2d-4d17-4e91-adbf-80f1be82f2bb", "comment": "Malware payload (Heodo)", "value": "19c139e917791f0d41f5cb53d90ea843dab05a04723d021bfed7887391fe4968", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864678, "uuid": "476c7c98-631d-4333-9086-c6bdc2fa1080", "comment": "Malware payload (Heodo)", "value": "20a9f0e337402ec91751a18476e755d0bd0807bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864678, "uuid": "ef163df4-9135-4cdf-ab02-d7d0eca9339a", "comment": "Malware payload (Heodo)", "value": "4fe6b06eaf7d5e179896772e6f9295fe3548c64b6e9d07de4aa1b97996cf14419ce748e6e5c3583733a8336c3e5bd10f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864678, "uuid": "ecbef60f-1b1f-4299-b8d9-a73ca2e72af2", "value": "T1E1F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864678, "uuid": "106d6043-f83c-4c6f-b0ed-1de1328771af", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864678, "uuid": "6307951f-0570-4255-b482-53e4c7236b82", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/m:JapiKiBEmj4GbOX399Md9J/0T0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638864678, "uuid": "53699471-ff4b-4fe7-888d-ff24d93b4f31", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638864678, "uuid": "af4f0a80-1665-494e-b843-f6ba09a6dea3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864678, "uuid": "14ba2569-e609-4241-b11e-f3fe66148756", "value": "1e32dce395f8fe5f9c3e7d29eb4a268a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091c3d06-5776-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638892501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892501, "uuid": "4667d934-bb0f-4db1-ae02-7791370cc404", "comment": "Malware payload (Heodo)", "value": "ef17666f7f509b8598318b444939e430", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892501, "uuid": "6831fd46-39b6-41b3-8e5a-73e5a0d2a633", "comment": "Malware payload (Heodo)", "value": "19c5f506c969bfa81a04d8fd8d7b15d9fe8006494ea05a62bf959f7a2e20ded6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892501, "uuid": "1c2603cf-f0eb-4cf8-bf52-fd53971e2928", "comment": "Malware payload (Heodo)", "value": "d72cc3daa94a867ef07856dfec4b2cb0b6b61301", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892501, "uuid": "b5a011a1-2de5-4f06-950d-640243f5f70d", "comment": "Malware payload (Heodo)", "value": "067889d2811da1af3c14f9a721edd4a73e38f4f3abfba2352c3df92a136908be199ea7e32ad5db8e8adcbb0da0081c36", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892501, "uuid": "7c8179d0-5b6e-4712-a859-80ccb953a133", "value": "T1F124D0B171808539FEBF66385D34D1845BAEBD90CB21ACEF7604019B9A685C08F73D7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892501, "uuid": "efbceca0-6a08-4fc4-bcc1-060938aaa342", "value": "35dc3f1eb8a03291fc0dc93396a967d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892501, "uuid": "67631bef-a79d-4016-9738-b4775d22d5d5", "value": "3072:MCDoXOpFVtI8/7gsEKr8x7tiUabb1mVDtzQhdYJBoo31kCsIN7Giz+w/gnViasLI:MGoX+VtZ/7vEKrWpwobrWo39sjC/Wss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638892501, "uuid": "5d2ce0e3-d680-4eeb-a2fd-bc469a84238a", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638892501, "uuid": "217adb55-fc4c-4768-a25d-52a3f498a030", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892501, "uuid": "62c7ebd0-957c-49fd-99ec-bbd5ea879bbf", "value": "ef17666f7f509b8598318b444939e430", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fec3747-574b-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1638874097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874097, "uuid": "d6b66635-88dc-4b3f-94dc-f0f1efa8d4d1", "comment": "Malware payload (SnakeKeylogger)", "value": "040c97d88d85a6125f0d00bc5173f94a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874097, "uuid": "223ac640-5d9a-4a5b-b97d-e83c6266f8b2", "comment": "Malware payload (SnakeKeylogger)", "value": "1a2eb9acfe8bb06d2b0e8e5124bbc123d4aeffacc0d129c7d9a2c36be3786b76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874097, "uuid": "5878e378-ef6b-4111-a2fc-109beb5ab20f", "comment": "Malware payload (SnakeKeylogger)", "value": "7d6f268c252f97a004f2b123aed5b8bafbf43350", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874097, "uuid": "2ae38bc1-d349-4145-bba7-a4df8a46124b", "comment": "Malware payload (SnakeKeylogger)", "value": "906c9e75b8027fe90a26a9f160455f003fa4eb5b2d6d2e0012b28e73eeef0052a333e8cfa0221cd37206a87332160389", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874097, "uuid": "388d47b5-f33b-469a-a716-dbeb6258e384", "value": "T19BD402B016A9CC90F81E867C816DBB3A56B96D951441C2F91E65FC26DF33305EB32B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874097, "uuid": "fd9ec31e-1be5-4cc2-92a0-f053e1ce0497", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874097, "uuid": "ecc99025-dbad-4ab6-bbf6-639e43582f2d", "value": "12288:553FW2oq2JBWGOa/dxm3lwfZmP1gL6KUz246pX6tGG:b3AbOaFwwfVLIz240GGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638874097, "uuid": "aeb247f4-5fae-48e3-b443-17482713a6c7", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638874097, "uuid": "0846b5d0-88c5-41c9-b587-e8c4e59df1e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874097, "uuid": "b3d186f7-5d1b-494d-bf08-960d185051e2", "value": "040c97d88d85a6125f0d00bc5173f94a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "933ca610-5740-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638869540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869540, "uuid": "1174e8f0-a4d0-4be1-9726-6f29b80ef451", "comment": "Malware payload (Dridex)", "value": "2fd5f4e71d6469dd363c02711aa55978", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869540, "uuid": "0bcaa3fc-28d8-4667-b80f-956d998862b2", "comment": "Malware payload (Dridex)", "value": "1a38328fe4aeb13be8c9adad12f22c2864bcd745d1c72c1190001e3962b57958", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869540, "uuid": "5f59ebca-d14c-4549-ad78-d06035a3a2b9", "comment": "Malware payload (Dridex)", "value": "2fc1cb52bae515cb2e88f687c804fc654f61bebb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869540, "uuid": "426a296a-8e24-4e2e-aeff-9ed87e04b0ca", "comment": "Malware payload (Dridex)", "value": "793e01b01e22add7311de961868a4199dfb9049048502cf44faecf9894b4c5fb2ec4455c38cd3346626c40c0f9f0149a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869540, "uuid": "91b24023-8df1-4265-9d98-cb2b1866fb35", "value": "T1BA34F8CEDEE6DDB0CF84C6768C0C9F409665DE541A1983C7B648A139BE2BEF4DB44680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869540, "uuid": "a43764b6-fb05-43dd-8912-da11d83bfc98", "value": "6144:Q96FE76hr0d3n98AdwL3x2bVyyKC7AXNHFgJBqwH/Pp4tvHUyxhQsHA:flgJEwHXp4tvUkhQsHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638869540, "uuid": "c373324c-e7e7-44e9-af03-0d33de242d41", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638869540, "uuid": "0951996c-276f-4b3c-81e7-ba81fdbd7176", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869540, "uuid": "5bddf2fa-9c2f-4f28-855f-ef50187ddb9f", "value": "Insurance act_977460953274.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ee2142-5759-11ec-96a4-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1638880194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880194, "uuid": "f3393b09-ab94-4d20-9693-95755f1e99d1", "comment": "Malware payload (CryptBot)", "value": "f4ef6aa2700949678fa7eed6a6052eaa", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880194, "uuid": "88886f73-aef5-42df-99e9-6e844d006663", "comment": "Malware payload (CryptBot)", "value": "1ae35e6e43cdd24d83cb40c5bf47284ddff6723374fcff47535e654d091e62ab", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880194, "uuid": "e1203543-e6f9-45e0-8426-da27b8901d20", "comment": "Malware payload (CryptBot)", "value": "b4a23834cbec78645e11c5ea329324ad2493e1eb", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880194, "uuid": "37196a8f-fd94-4044-96e2-73733d9adeb5", "comment": "Malware payload (CryptBot)", "value": "b2cfea9b67312dd3a30c36d2f8f5f46bc445135a3845c4bbff29e37d31f35f5895481b5ed487093552e272878c0e00a8", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880194, "uuid": "401872b1-74c8-48e1-836a-9e31a7b44b2b", "value": "T1A094AF10E6E0C035F5F256F44AB99368A52F7EE16B3454CF62D426EA4778AE0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880194, "uuid": "96980cd4-7f91-454d-a3b4-e166b1fc45ec", "value": "bd61429d86f194f3b84d97af55b8c371", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880194, "uuid": "e1046152-0dc9-4197-918f-36a262221695", "value": "12288:qQlqfpkq9mTnN7Tszl4rlPDX2dkSVPJ5:py2E+JjrS1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638880194, "uuid": "ccffec59-7f42-4e70-9991-dba21407962c", "value": 415232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638880194, "uuid": "7366d980-826f-4368-8f17-e72671933bb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880194, "uuid": "f080b010-c1cf-40b2-9f6f-ee44cb7d421b", "value": "f4ef6aa2700949678fa7eed6a6052eaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c3e902-5769-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638887234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887234, "uuid": "2942be76-12e7-4c96-b709-9a7d8d283979", "comment": "Malware payload (Mirai)", "value": "0ccd6f29da292afc0d39d076a6ef203a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887234, "uuid": "8f84ce4b-9d46-4487-8e9e-d4551b3e1e47", "comment": "Malware payload (Mirai)", "value": "1b21887007bfdc1bc9c7c8478d3dab28366d2681ef9b1def19f44be99975ce41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887234, "uuid": "783aa310-b26b-466f-b726-9ad35e09a8ff", "comment": "Malware payload (Mirai)", "value": "9b6ef142f1d347523d6c9720f2213283759afc85", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887234, "uuid": "f194dbee-9367-40a0-b96d-9abd3d5526a7", "comment": "Malware payload (Mirai)", "value": "f9f50c97e9d74bcf2326f949298eed7b36af81c9b5e407acf2ea71d6af18e31286bc326409d62240cc57e6e91aed6d61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887234, "uuid": "e0185d38-e29b-4ea6-afb8-58546d306d04", "value": "T1FC03F1E742EEC751B039923704EF182E5E501118B2474BE74F4109769AB2FA67C182DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887234, "uuid": "3c377f8a-ffde-425e-b643-2cb1d6a2edc9", "value": "768:34QnL8q7HOtmjDOeR9cutMKT9+tXWCpq0nbcuyD7UHQRjqDmGeS7Yo:IQnL8mcmjDOeRWuvTstXWYq0nouy8HyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638887234, "uuid": "dcc83478-c80a-41b9-b1c2-d83978499c18", "value": 40568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638887234, "uuid": "fbe16e72-4ceb-4590-8b38-7d2a4f56b6ee", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887234, "uuid": "63abd5e9-44cf-4ae1-b18d-f962d1457c01", "value": "0ccd6f29da292afc0d39d076a6ef203a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "792b0993-5749-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638873361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873361, "uuid": "81e060c5-38f4-4fc6-9b7d-9038bfda695c", "comment": "Malware payload (RedLineStealer)", "value": "a6fe288d87226f784eeaca4a4fbe8c06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873361, "uuid": "46ba079f-6a53-474e-8660-710bc6141312", "comment": "Malware payload (RedLineStealer)", "value": "1b4e1e9586e86d4728bb9396fe757b258ca6d5f36f8b277e7a5aa19c35c88451", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873361, "uuid": "e7106fbd-4f06-4597-9fed-7fd9cd65b935", "comment": "Malware payload (RedLineStealer)", "value": "3c83d0eea596f0028f9279fa17e444dc33fa250f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873361, "uuid": "8529c16b-ad38-4f9c-9287-30b2950523d6", "comment": "Malware payload (RedLineStealer)", "value": "cf5a2945f725b97f88cba228de6d9a1b8f6221170268d746dbf783255d9b5a20abc97839c77d66882a508b02db85e2d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873361, "uuid": "1c33eea0-4255-4f9f-bcc4-6726811a33e5", "value": "T1D7649D10A6E0D435F5B752F85AB99378A53F7AA16B38A0CF13D416EE56346E0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873361, "uuid": "5b72aafb-1194-4a5b-a026-1ccd8bcd3737", "value": "32bce393cb54cb1fe98663ad8ce84308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873361, "uuid": "af8f2783-f57f-4468-872c-b4842e3e75fc", "value": "6144:2oNPy+tLG3rJv32koUkZx2deKCDVuz1bug:2KPy+iJ/2ko1Zx2dRCDVubP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638873361, "uuid": "5f584f47-d3e9-47a1-ac3b-eb3f02e8be52", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638873361, "uuid": "12ad08b8-1517-4c25-b57e-373dd9dca467", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873361, "uuid": "d05db1c5-f490-44ff-acd1-d78577c167f2", "value": "a6fe288d87226f784eeaca4a4fbe8c06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c352d9a6-57b8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638921160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921160, "uuid": "6c08d9af-2033-4382-a80b-7bf69c962ce6", "comment": "Malware payload (Mirai)", "value": "ea19360bf9859ea504c359944e324799", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921160, "uuid": "885b532b-4c81-4d87-8db5-7a6eb1cc3c08", "comment": "Malware payload (Mirai)", "value": "1c5fad12c11b75de015350448fc14bb898c8d4cfbd204e85c34969c225329114", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921160, "uuid": "18c40e6b-ab2c-40f4-ab26-03a90b83c0ac", "comment": "Malware payload (Mirai)", "value": "9966f6aa3c1940b3a20cd56352ef83793adbfad3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921160, "uuid": "d6d2a662-7152-4416-8eab-251ea129b310", "comment": "Malware payload (Mirai)", "value": "d0a7de5000f8890cc8e9f7aee117418da1d8b3943aed75f78dac9fed06ababcbf1dae74fa69afc37c8e06596e16b568a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921160, "uuid": "1f3cd143-3e91-4a71-821a-003c3c61de09", "value": "T120733B8B64125DACFC5BE97585220E0AF82132125FA31F27A2D7FDA3BD23194DD0BD16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921160, "uuid": "1f0a5132-dae8-4f20-8365-0d72df167ad3", "value": "1536:7otNVzMx6v6TqCr4YX7Ov4g1plVBAGmjEXr436R+ZT08A:7QVg1SvdpTsMJ+xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638921160, "uuid": "e2c72025-ff8d-4cfb-ae62-70e15343720f", "value": 77328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638921160, "uuid": "4f01c061-fe76-46e6-842e-72379c5041d3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921160, "uuid": "384a8287-54d9-4ec0-8f7d-5ae99fe6ffe2", "value": "ea19360bf9859ea504c359944e324799", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aca0f37-5775-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638892128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892128, "uuid": "ae1992b9-43a8-4b1c-9b5c-8d2e4b552255", "comment": "Malware payload (RedLineStealer)", "value": "d96fa040cb70c8b7d98e99bb43673562", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892128, "uuid": "d55ccf29-6921-4e77-a210-7af78689df3a", "comment": "Malware payload (RedLineStealer)", "value": "1d0649dcd71aee50ce46d7b54eeacde67f06f06db0f958515c2f34d79637d0c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892128, "uuid": "10a943c9-57ca-4104-ac23-12794cef7103", "comment": "Malware payload (RedLineStealer)", "value": "52ee39c05d53627ae675eec3df46cc1b673dbd11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892128, "uuid": "e6caafdb-01e0-4aba-b4ab-dbf7155b252b", "comment": "Malware payload (RedLineStealer)", "value": "e01ccdb013e153f23a9f288e432f17dab56b7076d3bf89d3347fc8d7e06e95dcda20d32bdc97f870f77437401ac09afd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892128, "uuid": "cd7d8919-0e10-40b9-86b2-4c2f8021840d", "value": "T13C94BF11E6A0D035F1F212F89AB5A369B92E7EB15B3890CF13D457EA5A749D0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892128, "uuid": "44c6c21d-b38e-4b7a-b6aa-931203b8d274", "value": "b5d39f822cf46cb1cac0e9a27db40014", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892128, "uuid": "4c582d63-eaf9-41a5-ac9b-478bf16f0051", "value": "12288:leg/Qjat4SMq+3IHjh6AOcmTJ8BPyX4UfEa:g0Ft4SMqj9H1meu4UMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638892128, "uuid": "5fa615af-6dba-4571-9222-7b9bae5eff81", "value": 439808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638892128, "uuid": "b564b0e9-ff36-40af-8854-88646b05d2ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892128, "uuid": "c2a85913-2d17-45d9-a50d-e599fbf8cbc7", "value": "d96fa040cb70c8b7d98e99bb43673562.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b27342-575c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638881573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881573, "uuid": "02706444-e000-4e99-bece-d3abcbfb38a1", "comment": "Malware payload (Loki)", "value": "27c36cc1931a34f0dc19ca898eb196ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881573, "uuid": "e7014ec8-1dec-4a49-8a1c-0a9fabd8a0ae", "comment": "Malware payload (Loki)", "value": "1da487dcf49ac5e7f76e0cf453f80975a35c74689d39135f7758440054035772", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881573, "uuid": "1480cb26-179a-41f0-98ab-0b670b580841", "comment": "Malware payload (Loki)", "value": "e8fe8c597f910e85e2bee4f84c2b6488db728e52", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881573, "uuid": "916f1928-4068-49c0-9df8-eb1ea75015e5", "comment": "Malware payload (Loki)", "value": "623c34ef5c2e706de90e401ab092665024e3bd3bc84600cfb20ab8f5eedfc49887f71aeb4add77fb4f0ae8e491728baf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881573, "uuid": "bf6f1b34-8ade-4b74-889c-684f48b2451b", "value": "T1B9742306EDE16426F1CE98B6113F83BDDB76449203E11E87C7B46F6A3E3066772121A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881573, "uuid": "2025d73a-22b5-49dc-baa8-f55a66201c7a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881573, "uuid": "20b086e3-ee6d-42a6-a9d9-63362514d095", "value": "6144:rGiDsSMZ6zSOSrgO1Bs3JNlOsifRIrr8wH6AH0SmBJEZY7MXOpm6Mz:0pIzNSMO1GZnOJIX1HgLWY7MXDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881573, "uuid": "d98c102f-8bc9-4dfa-b747-94e804316a0f", "value": 361398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881573, "uuid": "8079d9c1-d973-4618-a996-60ec463231c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881573, "uuid": "35af6da9-9127-4468-94aa-f68677351587", "value": "27c36cc1931a34f0dc19ca898eb196ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8309ea15-5722-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638856628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856628, "uuid": "38594c32-589f-41fb-99c4-5cd5c31c6fda", "comment": "Malware payload", "value": "4aa03c9d6828dae54ca24a10c5327989", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856628, "uuid": "328ba5f6-a009-4e1c-a026-1ba98b1c340d", "comment": "Malware payload", "value": "1eeda5b5a7d3d674be4866ecadef57351b65324b730bfa6d9397349245a88007", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856628, "uuid": "a0667b6c-4f69-426f-9672-3e539b89a865", "comment": "Malware payload", "value": "f3ef115c4e390ae7aaa41408a67903b4ff2083c2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856628, "uuid": "b4878d48-9805-4b5c-b75c-9e0820536ed3", "comment": "Malware payload", "value": "54087b07554cf8862b5e9fd50b17a2a89f62ce868691e6ccc0464fea0a9893ee07376a004cd07748cff1683ae6a1b87d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856628, "uuid": "b51a5aaf-562a-4f7a-b15f-324466dd3d55", "value": "T186C49D1277C2C0B6D56F02714906C31D72F2A5908FFA86C7AFD94F3E6EB01D29A35626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856628, "uuid": "09c0a28c-fd9a-4502-a059-cadc6309669c", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856628, "uuid": "68036345-f0dd-47e8-a521-b28fe9e2c06c", "value": "6144:WKEUPDI8HTI4IPualOM8Vka11WqQtXwpomuU3rNOW1V1d7JI0Lm47XsMAgHsT23O:WKEUkuAOLka1miSmuYr1V7wAobS3qTHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638856628, "uuid": "53a1c1ab-459f-44c6-bbe9-60c5a1a5d258", "value": 559823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638856628, "uuid": "99345934-06fa-43c2-b83f-c32c9bcc9879", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856628, "uuid": "f7b8dbfc-a5d6-41ab-8989-0b17a4f74297", "value": "emotet_exe_e4_1eeda5b5a7d3d674be4866ecadef57351b65324b730bfa6d9397349245a88007_2021-12-07__055703.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b614e9b-574b-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638874036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874036, "uuid": "03d5b6f9-06f1-40f4-8232-3b5fcc5c490a", "comment": "Malware payload", "value": "3b71b7d412ddc0e5f6291671bb5fb555", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874036, "uuid": "bf7cf314-0d4d-4815-9449-0bf487cea4af", "comment": "Malware payload", "value": "1ff0afe0b3543cb919221cf17a8a3fd023b8f04382fc51c4758f6a97aceba865", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874036, "uuid": "9bb3d039-de67-445b-a289-31ad20050b5b", "comment": "Malware payload", "value": "0682636f42b7e16921c75e44d15a4eef1a539219", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874036, "uuid": "7825743e-df75-4467-9981-e08c19150fa8", "comment": "Malware payload", "value": "4ad0399eeb84021ee42bd462eee59d4134c011317fc029e9e6cbaf69e24b0190cf17d85aa0bfe6878cf1a7a327aa5007", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874036, "uuid": "5471a6c2-fd59-453f-b81c-ceeb44276566", "value": "T1CA559E23F2C14437D1732B349D5BB3699D3ABE206E29A84B2BE41D4C5F356817A362D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874036, "uuid": "77c8c0df-469e-48dd-90e2-65a5c63dd70f", "value": "24576:qe5liFKP5qUAW5A2jj/lp2xWx9S262u5+L+MAJ/TU+ptG1e5rYSASA:qe5dVzlIx6LLABTPptGIrYS3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638874036, "uuid": "e5b0a4a6-417f-49a3-aeb6-c79e69e7a673", "value": 1348096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638874036, "uuid": "6caabb60-7a4a-40c5-b32a-46fe3958dc8e", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874036, "uuid": "445d1430-2e81-4663-a9a2-a908ff18b511", "value": "Archivo.Adjunto.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abbe358b-5785-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638899216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899216, "uuid": "b7231e34-ce81-470d-8592-12c419992b73", "comment": "Malware payload (AgentTesla)", "value": "b14a7cdd93653b8a8c15bd635b85dccd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899216, "uuid": "fb54fae8-8f07-42c0-9df5-604583d00e23", "comment": "Malware payload (AgentTesla)", "value": "21029d7af84e818c88ef3c0960b4c6b226be4cd0dd6f634d3fa0b7efe3e32ae2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899216, "uuid": "19fc5942-c03b-44b1-a69b-db4a6231583e", "comment": "Malware payload (AgentTesla)", "value": "bf6042dddd4d3eeda43683d6ef992e63e7b14ec7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899216, "uuid": "a6477bea-27b4-47f5-ac81-093bdacb913f", "comment": "Malware payload (AgentTesla)", "value": "f5aa4cf143ca22ac0b3bdf0a2b65b6b3442414b7b210a857f6182665a32fd260f6f3c04de3717741e73de5ccf45584e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899216, "uuid": "3a6596b5-b237-4798-a9c7-0cec2c31b0e6", "value": "T12B45026C355BA1CECA9872753FA5D0B813243CB25827C26EE0D93E4B377F2473522666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899216, "uuid": "dafe0384-2582-4db2-a087-4e53a1522341", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899216, "uuid": "ce39bda9-2d5e-4364-80a3-bf86c1d16b93", "value": "24576:wxy2nyoIwbWYjw23GXEY9QytnjWbI1Bs9rb1DwHTmg4Imd:wjJiYjlWfVjW81wfeHTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638899216, "uuid": "ea53a1a7-924c-42e8-b33e-3374a333eb97", "value": 1254912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638899216, "uuid": "2e285c22-fe82-479d-88e6-3d56b1508b2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899216, "uuid": "5f2e6fad-3a5f-4834-bd81-f8641b2be726", "value": "Enquiry 234667981313.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c718e742-570e-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638848152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638848152, "uuid": "4dfc9121-a106-4fd4-aba0-8d95e94bc927", "comment": "Malware payload (AgentTesla)", "value": "fe29953a82e9b728b139f33c6d664904", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638848152, "uuid": "7af62aa7-084f-44e4-bd46-45c0724feab4", "comment": "Malware payload (AgentTesla)", "value": "2144ad1f411dd83cf4678317899aeba41aa1bf51d2de6805a4f56ffad82ad48e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638848152, "uuid": "b3b80505-409c-4de1-8393-452d60d8fa97", "comment": "Malware payload (AgentTesla)", "value": "e1008ee94be4aa0e44676d627fddc5cb8cecad21", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638848152, "uuid": "d3ee46ba-2ddc-41d7-b332-cf709260ab68", "comment": "Malware payload (AgentTesla)", "value": "fc36a62b50300e61acaab33befe98978d2c7b3f73ca7ab08a7a309d5320b4d16986985b702ecb9f04bacedd77e1cdce7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638848152, "uuid": "f885d107-0f6e-4c7d-964a-421a9a6c2011", "value": "T11E25230251F08B7EC4FA9B754A3590904B71B20B7D22E67C5EC5BCDE3AE7B108B90A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638848152, "uuid": "a349b252-8495-4d37-8e8f-25706b0b58da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638848152, "uuid": "2b241fed-10b8-4e6b-b6f0-5ad4434c8610", "value": "24576:ivZgvftvcD6msulQ4qotWF4qabIhR78Km/Oj5C9A:ivKfdBLulQlMqabIh1v5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638848152, "uuid": "23328ec7-c91c-436a-9388-126a70528606", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638848152, "uuid": "3d4648bb-22ea-43aa-9d9d-db374a83b1e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638848152, "uuid": "cba40f10-dd70-4c95-83e6-992772d0f30c", "value": "purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e4c608-575c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1638881590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881590, "uuid": "8d85b20c-b2e6-4129-9de9-1d958ccdf0bf", "comment": "Malware payload (Smoke Loader)", "value": "a6e7910146fecdecd20bf89bb1be0f92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881590, "uuid": "86dd3766-7c2c-4b90-9742-81269a720405", "comment": "Malware payload (Smoke Loader)", "value": "21837b705147ad533b64db7fcf2170662da3e2f9210d410a75caa83380e9a47f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881590, "uuid": "84cbeb8f-853a-4fbf-ac4d-ea22868273eb", "comment": "Malware payload (Smoke Loader)", "value": "81866a8450a9cd58435e59289966a3db40f09f78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881590, "uuid": "73146090-0f3b-4e0d-951c-125b5bac6ede", "comment": "Malware payload (Smoke Loader)", "value": "f7efe6b115bc4599ecafc6d897ac89637299ae6893b5dd259f9c3cbc22cba6fba266e9c72cfd0a92ceebf28001a972d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881590, "uuid": "91afe808-616e-4cb9-a7a0-6246e3443459", "value": "T10D648D10A6E0D035F5B712F85ABA9269B93F7EA16B3490CF52D417EE56346E0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881590, "uuid": "24abb554-33af-422c-b5b4-c7665aae4bcb", "value": "32bce393cb54cb1fe98663ad8ce84308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881590, "uuid": "567730b3-eaa5-4522-a1de-0d4f2cedbcd5", "value": "6144:b6WcSqneDUf+kPUxZkKNR0R1V+moPcX5:bL22q+kPcZkKNWR1VuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881590, "uuid": "c94d0af0-9f9c-452f-a55b-0a94cb7e0830", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881590, "uuid": "1f08c51e-8543-4634-a34f-7d896ff6e43d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881590, "uuid": "3fec4c27-414d-4692-a806-9b561704156a", "value": "a6e7910146fecdecd20bf89bb1be0f92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "536a0998-578d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638902504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638902504, "uuid": "35b0629a-657a-4439-ad2c-39d3af7470ad", "comment": "Malware payload (Mirai)", "value": "47d05c6ad8e5597edfc412e54e1ca179", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638902504, "uuid": "a2e237f8-28d6-465d-a66f-8773e8465988", "comment": "Malware payload (Mirai)", "value": "21e1e1d185afbfbcaae5cf73152e43f0b631c5d11e5ce483ce84d4c5e7704c09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638902504, "uuid": "e34b8211-b270-4fe5-b7c9-bfc89fb65bf2", "comment": "Malware payload (Mirai)", "value": "149a46864f32b2799cfa0a8f52bbf6b48d1d2b56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638902504, "uuid": "e0f38b56-2ec9-4c02-9f58-14002397b973", "comment": "Malware payload (Mirai)", "value": "3100ebec70752416afa5e92ae96e611415d24d1e927323a589cc37c5e09458a559a708ee32721ffc92406770cce07dee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638902504, "uuid": "a540c331-12db-4d9f-9eff-dab2c11123b3", "value": "T1AF535C21BD3E2E17C0D4B47B62F78754B2E1274E25A4CA1E7D720E4EFF12A4066631B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638902504, "uuid": "16ebfd5a-5639-4818-94f3-fac5a63c6c64", "value": "768:wVoEN7X6F4mvqvgqW7Ntzma6eFDaamv2qBtnO+CPKWgrqmK:wVBX6F4mvqvgqW7NPuaYt72ezK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638902504, "uuid": "ad3f2570-d382-4bc7-ab25-d4133e847756", "value": 61076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638902504, "uuid": "605e37a9-05a9-4c18-98cb-212232cb1529", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638902504, "uuid": "d1b92148-4fe9-4649-8ef2-876ec3a02c9d", "value": "47d05c6ad8e5597edfc412e54e1ca179", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d62c45c5-574c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638874806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874806, "uuid": "1f3119eb-2dbf-4baa-a591-0f1fac303cf5", "comment": "Malware payload (Mirai)", "value": "19fd1ca9c1b0f5177865abbaf97705ae", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874806, "uuid": "b8a6b812-fa2b-42c2-a62a-9cd821109dd4", "comment": "Malware payload (Mirai)", "value": "22d6c683122562463b531729525ac896a9afffd63dcd527ee3a9f484500b960f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874806, "uuid": "936e7ff4-1a0b-4ec4-a73f-411da9e954fb", "comment": "Malware payload (Mirai)", "value": "079e8855091e1a6f94c83d03a734e143a45ba7c2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874806, "uuid": "e2f0fb62-8248-4f1f-8508-4494e2036406", "comment": "Malware payload (Mirai)", "value": "8360096c666ca84971db3e0f5a71cc16b2b4d5258c2599643cac7b9ca2095945857e99f8c038dd2cded0ff656e7b9513", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874806, "uuid": "eb6ec918-2e5e-4a9c-8b7d-835d788ee074", "value": "T147D35D46EA818F03C4D5277ABAAF41453333A754D3DB730699186FB83F86B6E0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874806, "uuid": "72c39b62-2528-41bd-8d6e-d5c9df8a24ed", "value": "3072:qXIn1uz5pDpW0/RNZaNEM1ekk/jGBT3JdX1O3M/94DNn:SIn1u9pDLfM1ekkbGBX1SM/94DNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638874806, "uuid": "c2a6e056-2a9f-49c7-b166-3e61b57a612d", "value": 135349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638874806, "uuid": "a8a67cf6-cb1e-44e7-b127-2c9b26f6a15b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874806, "uuid": "b577088b-3032-4bd7-b5a4-a35106881653", "value": "Hilix.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "518b89e9-57b4-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638919251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638919251, "uuid": "d7764976-5698-4e5b-8635-05b6523e3093", "comment": "Malware payload", "value": "284b03154b7b511425342a0abae35388", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638919251, "uuid": "5f7851b5-8964-40c8-a644-ed94c6c7df0e", "comment": "Malware payload", "value": "2329018641118f8138f32a49b862312cb416c939854bb8fc953e08a5e25ced1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638919251, "uuid": "6eff8718-a7f4-44c6-8935-c227eb1d3034", "comment": "Malware payload", "value": "80e00b8cde0686412c3c3cc215b806b20ea153bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638919251, "uuid": "d2774785-3b17-4f21-a94e-e5714b977a08", "comment": "Malware payload", "value": "191786b2b61383eff2591c7a9874d178d79ea22ca23c5cfdde4a146e51602c8a980ce3f629ae24133d698f24559f1849", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638919251, "uuid": "0f2a0165-09ed-46a0-b95e-96e53d49114f", "value": "T1A8359D1A725502B9D077D03CC9874B52E6B174068330ABDB17E06BAE2F277E25A7FB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638919251, "uuid": "24edaaa2-b830-48fc-aff4-3a728a59413f", "value": "d61fa58dc9fb530f6808a80c6e710152", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638919251, "uuid": "0d6fca4e-3006-41c7-9b80-728088cbc4da", "value": "24576:jTFXogxhWMBCurAhzoyyr3gvp4A34j+ic4exs6Yn9BA9G:v2gMMRXjA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638919251, "uuid": "9dca8506-72b4-486f-83af-d21251d087d8", "value": 1163776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638919251, "uuid": "173d0d30-4ecb-482d-ae64-0b2d543be37d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638919251, "uuid": "69000898-05c7-4417-a3f0-85c4493b2b4f", "value": "80e00b8cde0686412c3c3cc215b806b20ea153bc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed4729c-5772-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638890792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890792, "uuid": "91b76a64-1ccb-417c-89ef-9370f7bc6f8a", "comment": "Malware payload", "value": "b880788e5f0126af825b7a6639c68e6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890792, "uuid": "606cf639-e9cc-4544-b948-2a3446df948f", "comment": "Malware payload", "value": "233a1f1dcbb679d31dab7744358b434cccabfc752baf53ba991388ced098f7c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890792, "uuid": "403b345e-8e27-481c-9b07-99b2320df648", "comment": "Malware payload", "value": "c4485de9561ce8fbec9847914f224148fce9ded7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890792, "uuid": "27976273-3fc1-4618-8de8-49fe21b4344a", "comment": "Malware payload", "value": "ec8027e514f51cbe515ea0a504c5bd00b8b2efb6e5118efe92fa6516ab0ab9729a74ec6cb127ce5a9ba13ec6e9174085", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890792, "uuid": "03db51c2-47fb-4930-be8f-c1a1ea9abb81", "value": "T1E794BF10E6E0D035F1F712F85AB9D368A93E7DA19B7494CB52D466EA0778AD0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890792, "uuid": "88fd05ff-f10f-4bbf-9dc5-5bc2b1b08508", "value": "bd61429d86f194f3b84d97af55b8c371", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890792, "uuid": "84c51878-f514-421d-afb3-96f02b921ff4", "value": "12288:UV+xokRzzyFq1qoNecaNnBLbcxlRm7k32yTx1F+:M+xoMzyZ3rNh+/1BTLF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638890792, "uuid": "70b7c19e-4f76-463c-879f-799190362d38", "value": 431616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638890792, "uuid": "f2cc69b3-1802-40ee-b29e-61f967dff9c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890792, "uuid": "10a08eac-10c3-41da-8227-911551d3eef7", "value": "b880788e5f0126af825b7a6639c68e6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a20e3e6a-574a-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1638873859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873859, "uuid": "eeae77a6-7ac1-4b3c-8995-5a79e88e7f14", "comment": "Malware payload (RaccoonStealer)", "value": "8dd39ca099bb5850e99ac9dd1c0a8679", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873859, "uuid": "cf5c5d9f-6924-4909-9aa8-6b90a9d25623", "comment": "Malware payload (RaccoonStealer)", "value": "245df6eba42f4085247e9155c66b3e607f724f648da9ec5a673a75a500318e34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873859, "uuid": "d0706748-85ff-4280-bcf4-cc9a2405de3d", "comment": "Malware payload (RaccoonStealer)", "value": "c12ce82e5ddea4f5299b5f0de925c7e7e09faa88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873859, "uuid": "4fed025b-0782-4066-a0c7-8dc48bb1ef04", "comment": "Malware payload (RaccoonStealer)", "value": "793f81171b35f38d7bfafd6a0aa675f572df2ffe29d5b398b7e3c03ca2d1c5e25b73a59f0e08281af0e33655233271b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873859, "uuid": "e5a58cee-41e7-4e7b-836f-5ed0d711be2d", "value": "T165C4F11133C0C172D0A334768516CBB19EBEB83556669A8FBBD01BBD1F20BE1AB35359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873859, "uuid": "a8a6ac45-ce45-4056-be55-62b7fb40c0e1", "value": "c7a650b8fc202a1fa8b80922e43c34e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873859, "uuid": "ade7b05c-9753-48ad-8603-48548cf8478a", "value": "12288:5T57DNIJNvU6SAjhqfYWPik0OFCRR/oVryMQHuMjC3:5ThDN2FU6HhqXiZOF22SHuL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638873859, "uuid": "1c36958d-0245-4da4-b80d-7360c5d242b5", "value": 560128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638873859, "uuid": "bbc45e63-2272-451a-8cfa-e8313746d2fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873859, "uuid": "924a168d-2526-45a4-b928-6670e5b13009", "value": "8dd39ca099bb5850e99ac9dd1c0a8679.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f155dbc-5735-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638864674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864674, "uuid": "e2861f80-aefe-4ba4-8a58-21869e7e4257", "comment": "Malware payload (Heodo)", "value": "baff3d80cde9c3bcf049bde6cfdea894", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864674, "uuid": "f7b090ae-c98b-4060-a5f3-548fa983a508", "comment": "Malware payload (Heodo)", "value": "264553602544e65a6ca377e7d62ebe769b1115e66f0d713d7a2abcee04ccad0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864674, "uuid": "6155aee1-48eb-4ebd-9a37-85d4095ea2ba", "comment": "Malware payload (Heodo)", "value": "dca1c73945af105addeaf260359dfbc4e918506e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864674, "uuid": "331aef45-0f62-43a4-a5d3-b370bea1295a", "comment": "Malware payload (Heodo)", "value": "3f0b8bcc45d633c49894ef8031b53d3bce352a5d29511d3392b8de39745ad669872d7c2d181a56b1a9562fdc8e0a2522", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864674, "uuid": "c95abb43-1eb0-4274-82d0-dda45f215a7b", "value": "T1ECF48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864674, "uuid": "48ae8c91-61ac-4645-b31c-0038b69e305a", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864674, "uuid": "3aea352b-0f2a-4032-aec1-7e91db826707", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR//:JapiKiBEmj4GbOX399Md9J/0TZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638864674, "uuid": "87522e79-dd9f-4627-a9d9-695b9b12c598", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638864674, "uuid": "80d81055-0c54-492a-91d8-8aedc5fcc1a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864674, "uuid": "37d0c147-9822-449e-a622-011ef8e15564", "value": "baff3d80cde9c3bcf049bde6cfdea894", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16bf0ffe-5785-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638898966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638898966, "uuid": "5214bae0-4f9a-4ada-884e-eeb1c49fcc89", "comment": "Malware payload (Heodo)", "value": "a70190894441cffd444c83004ae02427", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638898966, "uuid": "6b66637d-c6c3-4b8d-b377-b479f6914689", "comment": "Malware payload (Heodo)", "value": "26bf80d4d1a96f2693f698fb8cf6c0eb4040cde8ff544c2968585f4c08fd41a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638898966, "uuid": "1371725d-f21a-4a06-980f-41e2a586e82b", "comment": "Malware payload (Heodo)", "value": "3bc53fdf067f2df616bf52bca2d12701d8e6a395", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638898966, "uuid": "75f60acd-a3e9-48e7-8b50-36877af82710", "comment": "Malware payload (Heodo)", "value": "5f3ccaff9359e3ced1099e327d5258137080cc86e3714efb5351e3ae115ff52f14419ebee93c259abac583622cae9aab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638898966, "uuid": "9ff9dbda-5737-4c52-acef-ad022835b667", "value": "T13024D0B171808439FEBF66385D34D1845BAEBD90CB21ACEF7614019B9A685C08F73D7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638898966, "uuid": "1cd234f8-eb33-452a-88d3-339b7c7da107", "value": "35dc3f1eb8a03291fc0dc93396a967d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638898966, "uuid": "abac5f67-102b-4e5f-9a08-7e7dae11e445", "value": "3072:MCDoXOpFVtI8/7gsEKr8x7tiUabb1mVDtvQhdYJBoo31kCsIN7Giz+w/gnViasLI:MGoX+VtZ/7vEKrWpwobvWo39sjC/Wss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638898966, "uuid": "2c635f9d-2b79-4b0e-a711-bd6d9c4f663b", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638898966, "uuid": "c7413cb8-5e82-4305-9c29-4692c645d369", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638898966, "uuid": "44b29d9f-b2d2-4f68-a4bb-b43aa7c68556", "value": "a70190894441cffd444c83004ae02427", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ba66c2-5733-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638864041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864041, "uuid": "1e6781b8-4796-47f1-8fa0-ba6ead4f7e59", "comment": "Malware payload (Heodo)", "value": "aef79e1febd6c5ff85924cfc4bf3ab80", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864041, "uuid": "3ccc145d-2f4e-496b-8a8f-1e81038fd16d", "comment": "Malware payload (Heodo)", "value": "27857180beebf3aff9b459aec69f50a6fb9d214c779dd8f021a87afd1dea9150", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864041, "uuid": "86acd3b7-b773-4696-a65e-91e6f20b7b8f", "comment": "Malware payload (Heodo)", "value": "9cfafdf0efe3ef403e5637e271dacdfb97a94bb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864041, "uuid": "7d204443-302d-4fe5-a5ce-2eeac624916d", "comment": "Malware payload (Heodo)", "value": "99b695969990509ac34808726a3322339c1996f4245c2b656e67a4ba35e9ee3840a527227fb265138b2eaf2c2cbc1564", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864041, "uuid": "66eaa456-0da9-4949-95df-b6e4e0615b35", "value": "T1E6F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864041, "uuid": "ee872f8e-d11f-4903-8e53-0d6c53522349", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864041, "uuid": "ab18da03-4cb8-45fe-a332-c5984d1e7b74", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/j:JapiKiBEmj4GbOX399Md9J/0Tl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638864041, "uuid": "9bcde0a7-320d-4882-b595-8eb9609b0a8e", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638864041, "uuid": "bd04e9e7-9cd4-425a-9197-3d58f1a3227c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864041, "uuid": "8e3d1b94-8ce3-4a88-acd8-cea065c58f33", "value": "aef79e1febd6c5ff85924cfc4bf3ab80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111bfd86-5785-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638898957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638898957, "uuid": "5b0f2d60-a0c9-4638-92b0-c566acf0981f", "comment": "Malware payload", "value": "10ff23e162ef490c25a0d216c6773934", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638898957, "uuid": "0f55de91-72f0-48b2-a628-c171b0431181", "comment": "Malware payload", "value": "27e101f7b8cadae7bd94b09bc7bea82c10b4c28d121c3d8aed4764dad6960883", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638898957, "uuid": "7d09cbfd-b345-4be7-a330-5eadb0b59f6f", "comment": "Malware payload", "value": "951e409972eb621d8ae31c3c9fae71235f0b2cb4", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638898957, "uuid": "dc39d61d-c27e-4bf4-92d5-84360dc81e8e", "comment": "Malware payload", "value": "133e42cbaa875449aac8976f44ef5214e95dcc72b3db99fe2fd4b373bfa273444bbd181207209ccc24b0dd60e0e0a50f", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638898957, "uuid": "709dcd8d-b072-46f0-87ed-bc873f81f80c", "value": "T1D182387EF58B0E489E96D768161ABBA5064DF11D738444E237BCDB383A4C9178B23D38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638898957, "uuid": "d7852cc0-6070-49af-bec2-3246bb4721b0", "value": "384:URC3RHlry5/zhHHQWo9guRRXRupEKMxv9O:tJy5VHHQWmRXRup0xv9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638898957, "uuid": "86f24930-ea22-4501-9c59-e8699be153af", "value": 19024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638898957, "uuid": "d4b0f1a7-fb8e-46c5-8063-44f317038987", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638898957, "uuid": "5f57de52-ba38-4fb1-8a05-9c4efe453dd6", "value": "10ff23e162ef490c25a0d216c6773934", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24faa315-5728-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638859047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638859047, "uuid": "67bd5b2c-77ee-4224-a8bc-0fff14d94cc0", "comment": "Malware payload (AgentTesla)", "value": "7e8acda63c2e9720a1034367b516257e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638859047, "uuid": "f2ed8604-a180-4ebb-ba8a-7a20282d814c", "comment": "Malware payload (AgentTesla)", "value": "287408c53584ab5ea5cb109c488772d6f9e83964064d82c3c3db5eae30cf14ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638859047, "uuid": "cd0f60a0-92ac-447b-a6b1-7796abfec601", "comment": "Malware payload (AgentTesla)", "value": "d6e684b64da83ddaef54047e6c170f7922444a8f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638859047, "uuid": "6cfe1dfb-5309-49f2-9ca6-ecf6e0513052", "comment": "Malware payload (AgentTesla)", "value": "27f84acd467158e78f7f12585246ee24d816e1d230418606a7b70ab8c8bf325af7740420791dac8c24f7aaa5922bc7a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638859047, "uuid": "cf2fb1c2-8310-4503-8fc4-8ceda7bb6a0c", "value": "T1483523432399C325C1FC0BF69A5061315BB3BE6B6295D76C1EC169FD11BAB884A0473F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638859047, "uuid": "35e38576-113d-438c-a26e-2b86c087adae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638859047, "uuid": "287147ad-19e3-43b0-80a3-8fe353022c2b", "value": "24576:CncDkLt6b7vpkLgFk9borUmtXVrSSN7MTMxZtAB5zdExEEbp9h:CikLsb7BzFkt4UaFr5AWMLziTbp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638859047, "uuid": "5ec41c47-41be-4895-a7da-b00e3782798f", "value": 1107968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638859047, "uuid": "94c6c4b9-5c6c-44dd-80f8-82988d099705", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638859047, "uuid": "daa70fc6-8753-4714-87c9-bb7b9b06f0ce", "value": "z272umDLC0Ihz32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77817995-5781-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638897410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638897410, "uuid": "a79a9541-ca24-476b-8275-08a02beac06e", "comment": "Malware payload (AgentTesla)", "value": "36b07ba6a7b631c31452cbba5a87962d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638897410, "uuid": "4251bdfc-435a-481d-8585-fb5a6d62d87d", "comment": "Malware payload (AgentTesla)", "value": "293027e6972e402ec100769a73fd729d2de19bc37c4e7c08aa6edc7b0121b2ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638897410, "uuid": "861d0370-e86d-4603-8a80-ec8196453baf", "comment": "Malware payload (AgentTesla)", "value": "e40bc691162f64716944d2f82a62838402605bfb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638897410, "uuid": "ecbdf29c-c238-4ee7-8535-79a2c0c9d842", "comment": "Malware payload (AgentTesla)", "value": "fc78137241e10cc931a109f832fe551bdc0da00ecf1e4aa83fefcc6b323099f3213baafb476769db3595952895ca7f62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638897410, "uuid": "2ebfdeac-95b4-4566-911f-efad4d01baf1", "value": "T19B35227C369726CEDA465376336340B85276BD32200BD1DEE45B326F183B6857A73A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638897410, "uuid": "46be95cf-3baa-417a-a993-1b841968ab49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638897410, "uuid": "e3532453-c0ca-4a85-9528-6b0a23435e02", "value": "24576:AdR7xo91rLpAc1XIKwb7PhM8LJU1d+J8P6w:A2/pDIDOoyDKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638897410, "uuid": "0665dbc2-b070-4deb-8c55-91d1469d001b", "value": 1094144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638897410, "uuid": "4c8292e2-a847-44e5-8a94-8e54adef0807", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638897410, "uuid": "931b9e19-c653-41e2-a56f-c96569addb9d", "value": "Order_4314_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae1b193-57b7-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638920689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638920689, "uuid": "9ad096b9-4c8b-487d-935e-f715c1629cc1", "comment": "Malware payload", "value": "741d3e8dd57b62aa9a5e00749288b082", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638920689, "uuid": "e98cbe02-092d-4435-83e3-613d8e42ef64", "comment": "Malware payload", "value": "2a29bae2551ddbf88b1cae6c537c49bee9e29f7dbd5aafab0d3a684d2eb615db", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638920689, "uuid": "260cf485-6ac4-45c6-b505-f18676e013fe", "comment": "Malware payload", "value": "3122904ff1314cb95979bafd5af66f095930b584", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638920689, "uuid": "e2bc72ee-0937-40a5-ae3c-4be1684a0ab6", "comment": "Malware payload", "value": "e3290f174c2937bd60787cccb4b6c6988621938a252b8d2b6407a75baeebc46b64b92419a3cb64800b3b0ad7a4e145b3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638920689, "uuid": "4bd3659d-5a22-4af1-a4b7-773d5bbc56e0", "value": "T19D553A3FAED6D0C8C50903B1C737A6279E35F47CE63796535B9A0398ADA1F0258BE190", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638920689, "uuid": "737f0389-1e9f-4e08-beff-ab5cd0e46cd8", "value": "1536:3zv2IxaPXI3C7t5HlmC9FRFwp2yyBzrmoepfr5euqWcUTCBqZVSI1xS6Og+eJ2Ih:jv2bwxaRF4yprSS16iaJXwrEQMwdvTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638920689, "uuid": "98f22b66-6f2c-4fa1-97ca-117fa1348bab", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638920689, "uuid": "9e3124bf-fc9d-4c5d-8a11-0300ca53a5fe", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638920689, "uuid": "a7776169-5071-48c7-9bf4-21ad92e1f98f", "value": "Stolen_Images_Evidence.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c6df1f-56f8-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638838617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638838617, "uuid": "b3203b38-bb16-4004-9234-05aacffdc501", "comment": "Malware payload (RedLineStealer)", "value": "a7676c7cb0644677a5b6a451ab862d22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638838617, "uuid": "99d5b6bf-22db-47a8-a304-0cbef3d5edf9", "comment": "Malware payload (RedLineStealer)", "value": "2a74f294dffc49dac39fe02731b54909ca200513d524873c134a904e04d2e210", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638838617, "uuid": "abecd6c5-eb68-4035-97d3-71a4b4ef90b9", "comment": "Malware payload (RedLineStealer)", "value": "36b4a45de67de766ad5814ff354f7f3c7faf0d03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638838617, "uuid": "5eabd228-c431-469f-aacb-db7c8d443cc2", "comment": "Malware payload (RedLineStealer)", "value": "6301f6506ff0c2f09e3b399b32111cac8484304c3bba5f82c8bb97dcaff27c9cc7fbe6b80361aa76073efeb84f334c92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638838617, "uuid": "44b0a39a-8547-4264-a881-8d013c6dc6bd", "value": "T16E65DF4033F96509F6F33F396A7A82248F7B3CA6AD35D50E5744A8AD1831A44DC7A723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638838617, "uuid": "223d6d5b-72a0-459b-a40f-112b974e140a", "value": "b81e4b103a0604d28457b608e15b5ac8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638838617, "uuid": "0c4d4058-4d8a-44e2-94ff-a720d2e3dbe1", "value": "24576:CgSJlgcKBLDFbRj1nQHLnisd8VCbMYb6FbTj1krDPEVwAkOM00ROLmB:CgS7atRj5QHLisimsTjurDMwEMgmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638838617, "uuid": "24568098-f5d5-4460-9088-0edb7deca8cf", "value": 1479792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638838617, "uuid": "858fede8-08e2-4a99-abaf-b07312e7438f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638838617, "uuid": "6eb8f372-d337-4c4d-8dfb-fa1aefe272fe", "value": "a7676c7cb0644677a5b6a451ab862d22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594a95f1-574b-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1638874167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874167, "uuid": "ba25157c-4841-49af-9ef9-b140fab189d4", "comment": "Malware payload (SnakeKeylogger)", "value": "b8a51c2e7894dc9740df407ac48ebac1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874167, "uuid": "0f070f7c-df7c-4bd9-9786-a3773bae2fde", "comment": "Malware payload (SnakeKeylogger)", "value": "2b4173dd7ab1163a08c7d6a9ad25dd3bef1cd2d7f9277807ee04ede858d5964c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874167, "uuid": "bc6085ee-e0ef-4ca9-a6f1-c2ee145016f2", "comment": "Malware payload (SnakeKeylogger)", "value": "d56d487d95d030ee2a2de2537ff96085087c32cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874167, "uuid": "8e579511-1aa3-4b90-82e2-c3fa507ff365", "comment": "Malware payload (SnakeKeylogger)", "value": "18824ed7413ed738104d9ebcc6c1a24bc356c50ddd95b151e5e3829934da0c5a7a23b475f0304265cb8343cbd3173f6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874167, "uuid": "4eccd637-1ae2-4505-8843-1b944963dcd8", "value": "T16E25231223C99730CEBE37B6993021F16779A96D3A13DB064FC6ACDC3A67BD98410917", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874167, "uuid": "48e73c6b-74f3-4023-a205-505e414404f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874167, "uuid": "bf280634-e390-4de7-92cb-1a354de50efa", "value": "12288:dmVAjnSZswAbZvHthMREnA8aIiBme4YHhVnhkhlmOie9REhnhdF463igrCnWmXHn:fbweb5ER1BJ1OQFhdF4EilnDHxQMTLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638874167, "uuid": "8a0dca3f-6ba1-4770-9165-09060c2e4b91", "value": 991744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638874167, "uuid": "27b33552-cf5a-4a72-86c5-e2500b36d5fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874167, "uuid": "28a50c54-91c0-49a1-b004-911c2ac89db4", "value": "BANK SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e840e059-5739-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638866676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866676, "uuid": "b319cbea-fa18-4591-a881-368935858646", "comment": "Malware payload (Formbook)", "value": "0c8cd38598a0527563372b835008408e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866676, "uuid": "8e6d74cf-87be-4284-a21d-160f7b6c47df", "comment": "Malware payload (Formbook)", "value": "2c9c9b9652e3a0330099aad2d82c28c43f9330d24343aad3428fb29df923334c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866676, "uuid": "3d8ff288-ccf3-47fe-b20e-0992052a22da", "comment": "Malware payload (Formbook)", "value": "8751a45e1c37f5f7b4fab06a0821afc534fabae1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866676, "uuid": "911f7971-7cdd-4ef3-9fa3-032628c286ab", "comment": "Malware payload (Formbook)", "value": "8ea100b42a932ac080490285eabb08f010dd94c422b8661044c834a6bc8e7bcc1f24a01c9988d124578aaf513c037ba0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866676, "uuid": "fe278000-412d-4a52-aad3-51dd55645525", "value": "T1333523E2EA16391F2B60E8AC9D7DF34CDF05AB9F5A0B708D685EBC51C1C9C10D99A344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866676, "uuid": "71262c20-3856-4fc4-9a76-12f0b8e115d3", "value": "24576:D7Maw5fGnyhR4SO/Ozdew32VUSU2W0ezkWvRHiRAl4:D7Maw5yyhR4SO/cYMGUlAezkWvRSs4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638866676, "uuid": "93d996d6-1985-45d3-9199-352435aa8363", "value": 1068260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638866676, "uuid": "fe3b5559-59e8-4eef-a457-6a5a4a06f893", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866676, "uuid": "d24435df-1d4e-4dcb-b7bb-4d64e6298930", "value": "THQT-ANOVA TRADE-QUEENA.xls.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afbf0d82-5743-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638870876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638870876, "uuid": "2be5f9df-7167-4674-90a3-ef9d7f585b81", "comment": "Malware payload (AgentTesla)", "value": "b8804a3d5bc2927acad902e236a10966", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638870876, "uuid": "d399dfd1-07fb-4dda-b7de-2a1a58ee5e1f", "comment": "Malware payload (AgentTesla)", "value": "2cbcb9c2c2b892bd24e0daf85f1c0fa0b16aa0019a2bcb193bf2f18aa0242693", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638870876, "uuid": "2e665801-ab1e-4f21-9d71-3672b481dc0f", "comment": "Malware payload (AgentTesla)", "value": "2f27a3a8f5cfc92238aab066d4a6652edcf563f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638870876, "uuid": "22532e70-9f04-4fda-97cf-6e5daf066a61", "comment": "Malware payload (AgentTesla)", "value": "a7fd4104126d669a735ad1af9723f8d74289d10f6781d0283e6b5b9703f2757550faa169cc937447c032ae79d9ef01f1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638870876, "uuid": "55766f77-a099-414f-8c0a-deedc282f806", "value": "T1D02523EB899F7D10E58D3DC24E9D2B9CC7C6BAA9B10CE8F153B468213507BA5E347015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638870876, "uuid": "3a17581a-456c-454a-9458-7bdaa6de3116", "value": "24576:jm7h8O5+tJx4L/U0Za5zPh8ZHgSFsHVa/aQ7qQ/dAi2hroP:67hxeJx2/XQNPh8NOitqWduhMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638870876, "uuid": "a83ec200-6cf7-413b-87a5-8d893738fe54", "value": 1051650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638870876, "uuid": "65ca8045-2134-477d-a4eb-6ae80c932e32", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638870876, "uuid": "1cba2da8-e5e1-4a67-9349-42ee20dd3564", "value": "Bank slip.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8536382-5776-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638892848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892848, "uuid": "135b5342-0fc1-4c1f-a1e4-530c791eb08c", "comment": "Malware payload (RedLineStealer)", "value": "7ae518b18fd62b4ba1f6b24057b1345c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892848, "uuid": "840f0ad6-e75c-411b-98fb-76083840d7c2", "comment": "Malware payload (RedLineStealer)", "value": "2d02f6088d94bc1176408e49f1f91f36008eac6bb8f25170b7024e8a60394805", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892848, "uuid": "922814be-586c-479e-ab94-68378e319972", "comment": "Malware payload (RedLineStealer)", "value": "2bf2c61c3a353bbfe6c0359b5a1a62b826b07843", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892848, "uuid": "212ce2eb-9cc2-4e93-80d7-bf0a8aac2f37", "comment": "Malware payload (RedLineStealer)", "value": "c391cfaf1e31ca9aa971380026186ae5e35697da0188e5e5ee1fe7ef2f23a64fd1f0a77edef05f326200ca8b8e6c21a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892848, "uuid": "0a29cd7c-86dc-403f-9da5-4a9cd9f7a133", "value": "T1F085334714154169EA7DC27C2AF42C5A60AF7F80A930BB413ED97C3B73BB5A046D6A33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892848, "uuid": "561da974-e7f2-43c9-ac70-4566ba191955", "value": "999fbee5ab195461bca2d1c6c66cd5c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892848, "uuid": "3e558974-1352-4e13-a205-d6986d8827d5", "value": "49152:C6krQn5tCwgrl6QKjJX5DJcaZLLgsWqME+U5U61bH:CJ8n5tkr9+15DJLSsWZEr5F1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638892848, "uuid": "f7476586-5367-4257-8333-b0d458d34d83", "value": 1865504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638892848, "uuid": "5049940e-425d-412f-873f-44926384ce1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892848, "uuid": "00d0fde8-30a4-418d-9e15-5fcb6589e1c2", "value": "7ae518b18fd62b4ba1f6b24057b1345c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb4590da-5770-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638890330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890330, "uuid": "be50c61b-ed44-4773-8d31-6a2dc9d6693b", "comment": "Malware payload (Dridex)", "value": "4e45a553e005ee4e8c225f74d01ab98c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890330, "uuid": "f9ddbe43-bbc1-4bf5-8773-337575056d4b", "comment": "Malware payload (Dridex)", "value": "2e5458917b858dcdf65182a597704ee57a33f1cb0ed385665e021f7f0895fba9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890330, "uuid": "91052a43-00bc-4db9-a855-65b47638e5e3", "comment": "Malware payload (Dridex)", "value": "c17900161b83e25ff8bd3f82c3a3726fec7434cd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890330, "uuid": "804669cb-0526-43cf-a8d1-821cc7dc89a8", "comment": "Malware payload (Dridex)", "value": "db1b438e7f7289c69b6f7b287cf0aef11a7715d9c5b3fb8998385b76e49380b7043ba6a9960eb66bc88bcbf71c57ec3b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890330, "uuid": "10f250b3-a36f-4fcc-9271-307c5c6519dc", "value": "T1A1D31862FF7B6CF2C949B7B7CA9A1290D3F2DC17222592FA1984731D2E306D14C4D962", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890330, "uuid": "40bab203-5bc2-4da7-b421-4ced94cb0033", "value": "3072:zk96FE76hr0dOAn98AdwL3x2bVyE/KC7Ax5/AZlFXQdjDEcjQ8helhl2s12:496FE76hr0d3n98AdwL3x2bVyyKC7AXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638890330, "uuid": "ccbf7b41-bef9-4a82-b040-fa00483e0f5a", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638890330, "uuid": "d79b5886-7703-4644-b7e4-8165a4808f8d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890330, "uuid": "433e1aad-f801-4604-8a7d-69fb95895fa4", "value": "SecuriteInfo.com.Heur.27532.30012", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ecbc47a-575d-11ec-96a4-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1638881907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881907, "uuid": "3526da35-7d79-40c5-be2f-46cf35a90be0", "comment": "Malware payload (OskiStealer)", "value": "5c40517b3b632caf07cb45afa5aa1140", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881907, "uuid": "f957a1c8-cdd9-42dd-b91b-7d95d6a8248a", "comment": "Malware payload (OskiStealer)", "value": "2e6bebcaaa746b7ab28bf74c49dc0b92b88f564f5b05d6cc414ea1d4aa5f10d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881907, "uuid": "77955478-8489-4531-aaa7-1ec859ad6961", "comment": "Malware payload (OskiStealer)", "value": "767c28385881fdc01b43b730aa50168f23d934f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881907, "uuid": "fb24561d-f6ca-4e73-b4d9-ba58a1a10a93", "comment": "Malware payload (OskiStealer)", "value": "1f4151d55ec338e8c6f33d3bf3a96c12d7035f7b0f53a0071360a44d11cd4de2303c669fe732c4276de9527e5d7592c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881907, "uuid": "b91347ab-0661-4258-8090-85c257e8eea6", "value": "T1C835127D3783A6DDD4528778372AA03017AABD36A013C69CE868359F58337857E73B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881907, "uuid": "104126f4-7b56-4202-9e15-8fe9c88c02bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881907, "uuid": "85354b09-4d7e-4e21-9650-873a8eb9f165", "value": "24576:UBE7CQJyMEOcwEok2WVVKXHXCrcGND/sI4W0cosb2GG:UBEuQsOcbok2WVsn6b/sg52GG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881907, "uuid": "526d20ef-dba0-4985-a999-30430ca950a9", "value": 1081344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881907, "uuid": "33464f8b-0dfd-430d-b00d-9c2956e735e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881907, "uuid": "edf9bd47-65d6-4751-9900-45bfe57b801f", "value": "5c40517b3b632caf07cb45afa5aa1140", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27fb9e9e-5723-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638856904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856904, "uuid": "28236320-edf9-40f4-acc8-de4691a52b0c", "comment": "Malware payload (RedLineStealer)", "value": "385d875fe7bb66491b1d7316cae8aec8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856904, "uuid": "fe642e5f-a250-4ff2-bd66-9383b3c46c01", "comment": "Malware payload (RedLineStealer)", "value": "2ede835a0ec280cfd3850b2e75d79b1944697b763218021f0750539a647a8a48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856904, "uuid": "71f91c11-369e-4644-b612-3b03482916bd", "comment": "Malware payload (RedLineStealer)", "value": "867ffe1151bd3aa242a84aef9d0155ed7e03a0f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856904, "uuid": "589d65c3-0a7e-49ce-8915-1e2b9f0b0496", "comment": "Malware payload (RedLineStealer)", "value": "1958dcb0d0d10b0f26d6d616c288abe03f22d2298295829672f98d878245d214431472c0e965d9a01de14933cba0f8a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856904, "uuid": "3ca0fbd0-d1c5-4b1a-b202-ea8ddf8cf17f", "value": "T149648D10A6E0D435F5B712F85AB99278A93F7AE16B7490CF12E416EE5B345E0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856904, "uuid": "803e85e3-7023-41a2-8b8e-683caf88f276", "value": "32bce393cb54cb1fe98663ad8ce84308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856904, "uuid": "e8dc903c-f5a5-426d-9d31-598bc42aa280", "value": "6144:CsgjrZmazpQirRHt3sQ/IkmUCZ0tDNfS1VenHPNVKa:CsgxmaqiVHBseIkm7Z0tDZS1VoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638856904, "uuid": "de5ba023-97bb-4ba3-b465-47beb73856fd", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638856904, "uuid": "6bd28e63-df62-4bbd-af37-cc7595464ddc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856904, "uuid": "5aa3d247-87b8-4f25-935d-1178ed7db9fa", "value": "385d875fe7bb66491b1d7316cae8aec8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec18b5c-57b8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638921152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921152, "uuid": "93639a90-8413-418d-ba53-382e02bf983a", "comment": "Malware payload (Mirai)", "value": "8a293875b4a3854d3872ddc659d743dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921152, "uuid": "aa6c2e99-e40b-4451-80d2-41ae535d054c", "comment": "Malware payload (Mirai)", "value": "2f3576b9c9fe7eb04add66da63a3eda78805fdb710f527b64b63d9af57ccdfb8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921152, "uuid": "46480088-b0fd-4c8c-9e9f-3a805fdb5c10", "comment": "Malware payload (Mirai)", "value": "6447467ac382ecbf2c3cf1a538fe9160eea42e80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921152, "uuid": "4810b49c-153f-453b-a4fe-de1915d980aa", "comment": "Malware payload (Mirai)", "value": "b4efb4d39b77a4d40ea9f2c5939c4180adfe53f4795420810a79ac06d650b99d5571d94e8221ccb4618a574e9ae202d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921152, "uuid": "5ce368eb-1efb-4351-9fa9-3719d37585b4", "value": "T17AC2E01D135940F1C2B01A70FE7EC6467AB77FEC91FC61166AA50A40B741A817BEC2AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921152, "uuid": "8d661b7d-5351-4c10-95fd-77c888034e90", "value": "768:AL8dknN4aeP2XLsZqJW4fu4uT1A/8cdas3Uoza8:AQC4aq2bGqJluzo8azt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638921152, "uuid": "36a699ec-c4ba-4481-9098-9fa2627b9d01", "value": 26124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638921152, "uuid": "b27e6149-8b96-456d-90e6-5ed7654f20ec", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921152, "uuid": "bcb075ad-d102-4ab5-b27c-26857829edbf", "value": "8a293875b4a3854d3872ddc659d743dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f84b5879-572c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638861119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638861119, "uuid": "c4604a14-ac25-490d-b609-eb1d52fc87ad", "comment": "Malware payload (Heodo)", "value": "84f2f789cb8fcc278568e863c2b73143", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638861119, "uuid": "35568b41-4d22-4f22-8f9d-c23f56132f94", "comment": "Malware payload (Heodo)", "value": "2f78a666a0993df0e31ba83be7657cf3cb2edd3b836ac7a9cfbfac7000d73dae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638861119, "uuid": "fd3ea740-f27b-48b2-a6f5-1e5fd7aeebaf", "comment": "Malware payload (Heodo)", "value": "eee01acd7a937d45eac4a0d0cdb0ced0e2e8b29e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638861119, "uuid": "9837417a-29b5-4ede-9f74-81ccad57c1ce", "comment": "Malware payload (Heodo)", "value": "65eb9abc493678ba16968de12040f92eb6226b2acafc15d488ce983b09ef810503d20eb3bd62fe21a7fc49452472c339", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638861119, "uuid": "ec248e8e-a555-4e74-acf7-182085b6e821", "value": "T1FEF48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638861119, "uuid": "df0a17c9-d837-4c87-ae3e-99fe7e5f70c7", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638861119, "uuid": "3e369a23-7db9-46f7-932b-228a729bf85f", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/f:JapiKiBEmj4GbOX399Md9J/0T9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638861119, "uuid": "7d1f39c4-d9d7-4e10-9668-ac2aa0f69bc6", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638861119, "uuid": "5c4a19d7-cec4-4d9b-952e-b066572aa013", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638861119, "uuid": "95d00394-942a-4819-b2d2-1f05b75f113a", "value": "84f2f789cb8fcc278568e863c2b73143", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "573a3a35-5735-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638864714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864714, "uuid": "373cfbd1-3dd4-42d9-b13d-fe2dc8e5f2e0", "comment": "Malware payload (RedLineStealer)", "value": "6831b69736755a71ffdea507c0993f62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864714, "uuid": "7b53d677-5d9a-4c96-8828-22eeb8560d90", "comment": "Malware payload (RedLineStealer)", "value": "2f966a783c59bab1cb065d0a5ee0e7e26f4dcc6d7e964dd22c9a2652a50d7faa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864714, "uuid": "2c55bf90-75e9-4166-a543-d0062256a2c9", "comment": "Malware payload (RedLineStealer)", "value": "8d01ba68264bffba269d12853196128687bff9b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864714, "uuid": "dddc76ae-4515-4035-baf5-351942d9fe42", "comment": "Malware payload (RedLineStealer)", "value": "f27b3990f3be8f412f402d73b72621afe992221f18316ac1583088640778174dccd0e169f74c8a573dedb0de9e3ba190", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864714, "uuid": "76da18ed-a7ff-4449-bf92-f0653a1774cf", "value": "T15DE423B357088823D45309F7EC17EE71AD18BCBB989A6EDF1299B40F11F03929D055BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864714, "uuid": "292853a6-f74b-4d7a-ac83-de683b7bff16", "value": "fd25bac5b14a3478dbc2e0096188e38e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864714, "uuid": "54bf083c-c869-4976-8c5b-223a612452f8", "value": "12288:aObqk6ztI7uoTd6kluHpyrXHpHwJrD8023cc+o0jVgIeJAFL6JhB/E8n:5qFucsyJDCccpmgIwAA9hn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638864714, "uuid": "430d3eeb-159e-4a52-9d9a-334ef9e6e9d9", "value": 710144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638864714, "uuid": "3e885516-1285-49cb-99ca-748edb3d61e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864714, "uuid": "eb91962b-06dd-448a-8f5f-bcd16dcfae95", "value": "2f966a783c59bab1cb065d0a5ee0e7e26f4dcc6d7e964.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d5d9e2f-5753-11ec-96a4-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1638877637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877637, "uuid": "91ecb86c-cc87-4a73-ab7c-dcfbf4ed68ae", "comment": "Malware payload (NanoCore)", "value": "e3df98a7a7c3ff2fc872005d89a82ab8", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877637, "uuid": "059e8d7a-3b46-49f1-a224-34478becd535", "comment": "Malware payload (NanoCore)", "value": "2fcfe49a6172347f7b87dfeff1fa4bf22dfb67750aba72f44f7e0111c8d8dd8c", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877637, "uuid": "0bdceb3d-c449-4aec-bdfa-1d7492c8b84a", "comment": "Malware payload (NanoCore)", "value": "84b626d2ca90679d41568c30a5b227dc86fd892d", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877637, "uuid": "193dc0b6-a4f2-419a-9f4b-3e0bb8b962d4", "comment": "Malware payload (NanoCore)", "value": "dab144cf2a4b10a063d96b7ad669faba2593a59310ec86dc657747d0d8495010fad2ec2bfae4ab73e3df4fb3bd344788", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877637, "uuid": "352330c7-9348-44d1-acb9-d4d31d8d2e6c", "value": "T1E6F09E8DE204AECD115294BFCCEB1C2F6452BC8B3FE4EC61F7165289A7094AD101945E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877637, "uuid": "532e5f6e-da4a-4b98-a8b3-a4a1db866476", "value": "12:rVlSpY6aVSUEUzVE0BY3nLjGGSRbNMWOXHC:rVlSS6aVSUEU5E0uLjUbNMDHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638877637, "uuid": "bd6f47bc-e674-4ccd-a328-8907e7ec8e63", "value": 483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638877637, "uuid": "57482617-d145-488b-a072-1423018bb87a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877637, "uuid": "0e4c41e7-b469-4227-aeba-5401850bebc1", "value": "B3M8D6F_Payment_Copy.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8450d445-5748-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638872951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872951, "uuid": "d7bffb2b-ad8a-4e57-a89f-8be53d9a627d", "comment": "Malware payload (Dridex)", "value": "a8b05f0781be741710594ec8616540c7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872951, "uuid": "94d98551-ab64-4f7a-b343-0c09ebb0b6fc", "comment": "Malware payload (Dridex)", "value": "30a27f834183c2c94d01d18838bed678f78aa07a09ba5cd1aec57416ef18a43e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872951, "uuid": "a1477076-7f9a-4648-a717-9739a95b3a81", "comment": "Malware payload (Dridex)", "value": "fac6283173d33ac0ec42603afbf7c0af18bf7bee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872951, "uuid": "15e59e79-6eda-42aa-b26d-44bd13c90596", "comment": "Malware payload (Dridex)", "value": "4680930da28a24fd72fe7e5223139618f3c94c6d907033a094f31c54e2a1ac2fa604ff2b4a65580a167c0bd1d4e1a820", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638872951, "uuid": "dda46327-2144-4080-becb-d4bb41b6cd38", "value": "T10483AE9EF86F0D2CE92E80BB14DF0EF407752E7905D2730A6BB09254AFDB2B78955060", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638872951, "uuid": "36758a15-cbab-4346-b422-517e715f645e", "value": "1536:FWpkO6PuZxUXEL150Txat4T0OkWr3m7mMQ1o2iwB1ICewT1HUM1paeLqKt3oQ8Vf:Ab6PuDs8Gd5IOvT7VIqT1HUCxh/8rdWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638872951, "uuid": "9a9a5285-e96f-4e56-8739-6d61b532b864", "value": 81640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638872951, "uuid": "e9b7cf37-cf70-4ff1-ab0c-da32737fcab5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638872951, "uuid": "4b3cbe2e-c731-4fe9-9240-8199fb040000", "value": "inv856837915323.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e3fde1d-5784-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638898549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638898549, "uuid": "e9f51db8-b368-4f06-a312-04c5002883e2", "comment": "Malware payload (Heodo)", "value": "eaed6dd937c0b4979611474f9dff5955", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638898549, "uuid": "48a50c90-4d7b-493b-9119-f11ae6454b2d", "comment": "Malware payload (Heodo)", "value": "311430a477310efc77a601b67d381069de9c87d453d432575a32e98796e3333f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638898549, "uuid": "19bf0c99-e070-474a-979d-02282e1a2339", "comment": "Malware payload (Heodo)", "value": "3a152d9b35094ec824835216c9ca176b01ba7670", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638898549, "uuid": "cf155ea0-c3e1-4fec-a437-5dff83e0f658", "comment": "Malware payload (Heodo)", "value": "c28cd5149eadb223c0529c51c30e67137edfc387abb603e73c461040ec820630c2e21575f35eb6d050f487320debd013", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638898549, "uuid": "e36ddf7e-577f-45c1-b93f-20411bbabcea", "value": "T1BE24D0B171808439FEBF66385D34D1845BAEBD90CB21ACEF7614019B9A685C08F73D7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638898549, "uuid": "4d1b39aa-ad02-4173-a68a-276edd9784ee", "value": "35dc3f1eb8a03291fc0dc93396a967d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638898549, "uuid": "c72122f3-29b1-4acb-8028-c2a607c1cc6c", "value": "3072:MCDoXOpFVtI8/7gsEKr8x7tiUabb1mVDtQQhdYJBoo31kCsIN7Giz+w/gnViasLI:MGoX+VtZ/7vEKrWpwobaWo39sjC/Wss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638898549, "uuid": "b46f4429-33d4-4bad-ab79-0b5cd31b4f4f", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638898549, "uuid": "81b6dc85-39dd-4f4d-a9a5-8088c66b185b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638898549, "uuid": "f4157140-5b96-41e9-80ed-dde9ff06af17", "value": "eaed6dd937c0b4979611474f9dff5955", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6687f897-575d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638881920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881920, "uuid": "409db3ce-8f1c-4e0d-b385-8fe0705f4eb3", "comment": "Malware payload (Loki)", "value": "5daed0944dd819b217f4822ba6b9b15e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881920, "uuid": "b52321df-12a1-42dd-a9c4-b3487dfb1a92", "comment": "Malware payload (Loki)", "value": "3240c6a8e8bcd54b5648d946e7733ed64e1797930c44bb9067f562a46cc43594", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881920, "uuid": "cf3ab39a-ce72-494e-b287-6a1a6926bcf7", "comment": "Malware payload (Loki)", "value": "40b1bd62d71e5829f50786644eb2a2cfdcdb37b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881920, "uuid": "63f15c99-0cb2-4bb4-a20a-47d3662ad35b", "comment": "Malware payload (Loki)", "value": "a88828760f1eaf07c0b8f90352b158d90b81b4f9ad98e6417a729bf9bae6c7a1123db8fc45fd132b65dd092b69162399", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881920, "uuid": "d0806bc2-9c12-40a7-bff5-e5237c52ce84", "value": "T13E2512BC36D762CEE98197753362917882BA3C37242BE25CE4AE711F1C277057A63352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881920, "uuid": "dbfe5367-884e-469f-9a90-9d5488294d93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881920, "uuid": "dcdf81f8-2bad-4cc8-b5c2-c502f830cd90", "value": "24576:cEmKlXlOP6jNJ5M7ToU2XIdIPuka5uQYf0:pmgGyJK6XBuka5uQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881920, "uuid": "216fb4bb-ec08-4c0e-b71c-773353b94de1", "value": 979968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881920, "uuid": "5475b846-6a5d-469c-b0a7-5748552d2f7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881920, "uuid": "4b0326e8-7e38-4839-9a11-dbc2933017b3", "value": "5daed0944dd819b217f4822ba6b9b15e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98699fe2-5786-11ec-96a4-42010a9c0029", "comment": "Malware payload (Zeppelin)", "timestamp": 1638899613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899613, "uuid": "6746ff63-1713-4d80-8c70-73b1f86b3e92", "comment": "Malware payload (Zeppelin)", "value": "2ddeccac750171b9c96c0bf6a343f1e7", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Zeppelin", "colour": "#9BEC2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899613, "uuid": "d5009639-660d-4399-b836-1a2bed894d62", "comment": "Malware payload (Zeppelin)", "value": "32478b96a685a4c4dbd7ff2e0a1b116669ff54c2b96bb778b3076519f8cd2a3e", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Zeppelin", "colour": "#9BEC2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899613, "uuid": "7f6539de-b88d-48be-8943-8f73bae4e5d6", "comment": "Malware payload (Zeppelin)", "value": "4671b9b59e5b232a68c6caec784575b107161ff3", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Zeppelin", "colour": "#9BEC2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899613, "uuid": "d0ef2e0f-9a4a-4ee1-b2e7-90364eab5c9c", "comment": "Malware payload (Zeppelin)", "value": "478efcf78c0c3859828edf15376618485a78b3309c9b0098d97691b40f44390cf51784bf9caf36281b1b1a26ff7719a3", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Zeppelin", "colour": "#9BEC2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899613, "uuid": "bcaba7ae-ef50-4675-8119-eeecc49fb3f7", "value": "T12E1423AC03C15C2009151FF5B95A2C6B6C80FD67700BDB6C0FA7DAE9AE85958FE1217A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899613, "uuid": "a161dbaf-9e28-453b-a103-c058bd4d5134", "value": "3072:WncfXbIO4EN6T3NY/CvcBVdnK4v1+wZyrYxjXPx32Aqwav7n00fRggR9:xfXlYB0nK4v1bZcYxjXPxGAqBDEgR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638899613, "uuid": "053fc4e4-0231-4583-9534-e81d29ec22c7", "value": 194603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638899613, "uuid": "5a5d6b43-929e-4c20-ab56-597a3d11b3ff", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899613, "uuid": "1f601882-27ac-4a5b-a0a3-9324b3bb28b1", "value": "1309820211207191831.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ff78d7-5757-11ec-96a4-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1638879403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879403, "uuid": "352039ee-feb3-4eb7-bc0a-5f19d2c9d8f7", "comment": "Malware payload (QuasarRAT)", "value": "c582733262840d2612e7c7204240ba57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879403, "uuid": "be3c064f-8c40-4e46-acda-e9e8739b167c", "comment": "Malware payload (QuasarRAT)", "value": "32d9547e28d4de02e5a227d1ce6db55ab2bbcb9179ecb2985a9a43a1371898b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879403, "uuid": "6b3ce161-0635-436c-8703-c3f8c126effe", "comment": "Malware payload (QuasarRAT)", "value": "bdadd3185cab4d7ce9100fcc84a07f34acd4a522", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879403, "uuid": "59aad62d-822f-458e-b5e7-4f59f0044b87", "comment": "Malware payload (QuasarRAT)", "value": "fbd5337474ad249f6b3cbca7d1ec2288ffec67f6f9e3e3c8dc4dd38ac63432921dc3934d31bc256a79250d35162ffb4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879403, "uuid": "b68c6ef4-c1bc-4069-85e8-5d7e4bcd1600", "value": "T121748D5373A4E93BD5FD1B3AE43606058BB0D407BA1AE38B5A5855BA3D133868D803F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879403, "uuid": "d54a3333-897c-400d-8a1a-f1a4af766ef1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879403, "uuid": "1968933a-f1c9-4d53-b83b-80e9bda6203d", "value": "6144:UuqQ4i1FFiEK7RTnI3qFoEQbSmXn55pHA6MEC:TpliVTn6qTPmrBA6PC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638879403, "uuid": "c8944e99-be41-41fb-b1c9-7dcf6431e2ad", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638879403, "uuid": "6d0545be-72cd-44d9-ab15-b35a2c5cd03f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879403, "uuid": "8d717d95-1709-4cd6-a5f8-451749d1d277", "value": "c582733262840d2612e7c7204240ba57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c57dc99-575c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Matiex)", "timestamp": 1638881554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881554, "uuid": "aa363a18-55a7-43d3-8cf6-9e638cc49e7a", "comment": "Malware payload (Matiex)", "value": "cff383a9c4716e6ce935e3b4132cef34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881554, "uuid": "569f952c-25bb-4115-8136-ed428bdcf807", "comment": "Malware payload (Matiex)", "value": "32de63f0ac703c7d654d2676af0b2b3fa08dced0bc918318a9d642a696a6a91c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881554, "uuid": "bf81cd90-4500-48e9-ae80-891664345344", "comment": "Malware payload (Matiex)", "value": "95fb309753bdb273b8da6cfef6bd7af012d7d11f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881554, "uuid": "78222ec5-420f-4f37-964d-ac6e84dca70a", "comment": "Malware payload (Matiex)", "value": "d6290e1f4efd559d2953e029c3140068ac3fab105f033d8a1454cb4e9cd125c5f97e9344cddcc5816c91802d5b2983fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881554, "uuid": "834ef3d4-ead5-43ce-a893-a535b3eef463", "value": "T1E484238975E894BBC5591274A43FE33DCBBAC2EA902DCF87AFD54ED934114C00E1B8A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881554, "uuid": "5c896dba-643f-48c0-ab68-c19df176ab20", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881554, "uuid": "e71e0f6d-9419-4c38-8e38-c0251e320072", "value": "6144:rGitXhqSTq2QVeZvIbMuWosJxuAXutmMzNktW9eylps6kmcJuLJZP8QwJy+cM8WZ:WoqyWoJxl+tmcNk5Ee6kf62QwwRM8WZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881554, "uuid": "35be214c-81df-4447-933c-04a976953536", "value": 401187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881554, "uuid": "4dfb94aa-072d-414d-a3ff-d6f6dd5ceb28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881554, "uuid": "cc45874c-2a0d-4bb4-8d3a-f82cfb204cec", "value": "cff383a9c4716e6ce935e3b4132cef34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90dec811-56ff-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638841618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638841618, "uuid": "d75ef1f2-8a0b-4669-b260-e2f6dbb52e2b", "comment": "Malware payload (RedLineStealer)", "value": "b16e36648d8e8adce3939322f918b5af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638841618, "uuid": "8f7b80f5-263f-4073-ba63-5a256e954407", "comment": "Malware payload (RedLineStealer)", "value": "3453526301d5a85ec4eaa158b5105d2e91cf882b8da865e26f64be4e25068c00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638841618, "uuid": "b0cd96ff-56f5-4f8c-93dc-f057589f49a2", "comment": "Malware payload (RedLineStealer)", "value": "3bbf6916ea85a451e65c9a266e780a4bf4f4be15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638841618, "uuid": "80bcf638-8df5-4405-a8d4-63f36136c69f", "comment": "Malware payload (RedLineStealer)", "value": "083df5ac6eadefef5fe54af614a1d75f9c8e9909634bad985454935470c10679fa7addc18d91093387bedc4ab46b0882", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638841618, "uuid": "a6212063-d961-4e03-8769-d951a06dc590", "value": "T16905127136D0C072E43704718DAEE772F93AB9742674918ABB840B5D6F32EA1C71AB53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638841618, "uuid": "dc238590-2190-427e-92d4-a5f129a88fbf", "value": "3eaa732d4dae53340f9646bdd85dac41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638841618, "uuid": "a72063a7-0eca-46d9-b7c8-c62c32abf5ea", "value": "12288:Aw35dS4X8AnVqNL513rvuPRXp7DFzabyAV3oRtxGzynnwotMbVWahVMQHF/4pdt:Z35dPp+X3rv+53Fzs9V30lwVMwOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638841618, "uuid": "1b2d35cf-bfc5-4235-a5ee-16a4774330a8", "value": 801610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638841618, "uuid": "ebcf978c-6c22-4fe2-bdd6-6448a07ac325", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638841618, "uuid": "d6f6210d-bde4-4cda-91a2-47ac1a3409e4", "value": "CONTRACT-PI LAND-LM-GROUP.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d33e92f-5751-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638876777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876777, "uuid": "b8cb16dd-bc8d-47fa-9c45-62cdd60a3dfb", "comment": "Malware payload (Formbook)", "value": "7dcd5fabc02392df1f93e1098076e11a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876777, "uuid": "b12912f2-dd97-484e-b689-457e1d4eaeb7", "comment": "Malware payload (Formbook)", "value": "3458a22bc04430d035eb6310673b60eeabef2b2bb8d455623f3eb0329d1d1a04", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876777, "uuid": "140675e2-3653-4c82-8f02-cc5de4a14248", "comment": "Malware payload (Formbook)", "value": "fd7f70d6138354cc0cf5cb212342309142656fac", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876777, "uuid": "1bc8be88-7080-41a7-8f53-e9df2d057d7d", "comment": "Malware payload (Formbook)", "value": "f9b72b804cfae34068a90cd8d35e56d7b0d6d61e785e229ebd3055b1f2abb1a6798c07975ed2167fcf87a6d15cb489c8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876777, "uuid": "052c1f15-23a6-44ea-84a1-14d3eae2d9af", "value": "T1D034124E71E251F7F0788DBF980DECBC48DAEC184BA6909A51493F8CB63A449DB53478", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876777, "uuid": "6f360838-203b-41de-9077-854eab29dfc4", "value": "3072:bKtjA3LzU4+VoDOcNkxa6o9hlJAjSSmEJYgRVMRsj+P687/xeupA0PGltA34vhRN:MjAnUmPk2JAjS2TXxK/0cAe34pRKvoT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638876777, "uuid": "9c27c6d7-753b-453c-a356-cb12d16b88db", "value": 234536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638876777, "uuid": "b0faf1a1-89be-4824-a783-a9a17cc80919", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876777, "uuid": "6b8b07c3-30d4-4882-a710-e440bcc44ae3", "value": "Product_Specification_data_sheet.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a433ed-5733-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638864036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864036, "uuid": "2a2f0ef8-8453-49ae-9c96-26376cc36475", "comment": "Malware payload (Heodo)", "value": "902c94de7db7cc7750e4e274b2aac8a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864036, "uuid": "d7a7b415-ac56-4c28-bf73-203116691370", "comment": "Malware payload (Heodo)", "value": "34b7215620467ead2b0bd6944668b0de79d12720fd09797c5aa0e37fdeba7f10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864036, "uuid": "0bc19ec4-4a08-44aa-8ee5-20dde924e3c4", "comment": "Malware payload (Heodo)", "value": "5dcf5c7d23496f000f3a21e2bdc6900a7b312c07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864036, "uuid": "dd0b301c-bf9f-4d83-bfc7-8dea266670a0", "comment": "Malware payload (Heodo)", "value": "3c065afe661bb8974699e1468f18c1289db249352a2f29fcdeba5530fba79872aaf1f1995b1499e606c97e8ab4bf7336", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864036, "uuid": "542deb55-433a-4703-b970-a1e8fcdcb228", "value": "T141F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864036, "uuid": "8d0a629a-5e69-4a34-ac54-98155f630981", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864036, "uuid": "9c17ab49-9b72-40ad-909e-aac5050ec7cc", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/P:JapiKiBEmj4GbOX399Md9J/0TZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638864036, "uuid": "9bffd5c0-3175-42f4-b45b-f0c1a9055159", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638864036, "uuid": "81305aaf-3d99-4628-bf0f-19d1c806bcb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864036, "uuid": "7399fc15-0e4d-4c73-bb2c-ebd02e839ece", "value": "902c94de7db7cc7750e4e274b2aac8a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7ced86-573f-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638868889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868889, "uuid": "4689665f-130b-4e88-a6f1-3c8462251aa3", "comment": "Malware payload (AgentTesla)", "value": "e2e3fa1a0575280f4452ab25acc5fed2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868889, "uuid": "83297045-21e1-4db2-8a0a-2125079d8c06", "comment": "Malware payload (AgentTesla)", "value": "35711cbb39d19916bab822a76286c576b2250dc6cb83d739a02ebfa04ae4a480", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868889, "uuid": "5fa0b429-3d77-4f50-b3fd-2eab5218c26d", "comment": "Malware payload (AgentTesla)", "value": "70046f06b01f365f5643386cd35f6a4465adbd1e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868889, "uuid": "366a3232-6c3b-40f8-a434-3e28663d51d5", "comment": "Malware payload (AgentTesla)", "value": "e46feef8274e588c473818e078e6bb247ba6a778f8cc29d186cce6a172c3046a75ceba74265b008d675c2d686f0910c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638868889, "uuid": "02e4122a-a1a2-40f8-8e59-cd6931e6991b", "value": "T1013522BC385762CED1889BB937699038A1717C37641BC28EE866329F19377447A73B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638868889, "uuid": "09661b4c-9f26-465a-95aa-39b0521e06ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638868889, "uuid": "65f73378-2b8c-46f1-85ea-ead1ec585fef", "value": "24576:rfprLNX+4UUQKawF2QqmROxNph9xjr4QB:rfprLN52K7F2QqUODpjxjr4QB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638868889, "uuid": "2e5a4825-7354-4d1a-a31e-3408a6fa6282", "value": 1105408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638868889, "uuid": "2b151713-c8f9-4b8d-a4fe-8c8dd2a7eaa5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638868889, "uuid": "7225f723-4e65-4a00-a44d-27ee6db59a7b", "value": "psNIMtaDiLpfvme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f55135e9-5774-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638892038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892038, "uuid": "4127b4e9-fc0e-4b0a-9293-0e42dfc3db5c", "comment": "Malware payload (RedLineStealer)", "value": "97ca96f2e2ea15774cf85e5634b4dfe1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892038, "uuid": "c52f8dcc-d6fe-4ced-ac14-df6c84ca01c9", "comment": "Malware payload (RedLineStealer)", "value": "358c7a01868df7d423f3927b34289141148729063cf995afeafdb343752d6d12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892038, "uuid": "ce1fdc53-8905-477d-a579-14fb6d6c65ce", "comment": "Malware payload (RedLineStealer)", "value": "5f02478b6d02760c98f6af7873bc780b6a123c0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892038, "uuid": "609e711b-6f3b-437c-9de4-a895bf51c2d1", "comment": "Malware payload (RedLineStealer)", "value": "bc81617b02e3a2a49bd7bf561579a1c12265c469507571b2ebd0b2fe14023212b9e602eae7370d16cc0c3ee7a3189d87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892038, "uuid": "57e6d2b2-0e5d-4831-810c-f021d264150d", "value": "T14394BF00E7E0D034F5F316F85AB5A369A92E7AE15B2494CB53D526EA1774AE1EC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892038, "uuid": "b07004a3-3811-4076-9546-d9c51b2a5c04", "value": "b5d39f822cf46cb1cac0e9a27db40014", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892038, "uuid": "8781b411-4248-4767-828f-a839aaa7e426", "value": "6144:kW6I2gONbg3r/igKfLZHh8hJLDpqZ0FfAqUuKE+SnrOW/YxmDgvFABN:kW63bc2j8pEsfAqTKE+SnSW/YUgvFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638892038, "uuid": "9dc74924-8c27-4938-ab52-f6f520fd3018", "value": 432128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638892038, "uuid": "f8988ab2-444d-46cd-aba7-c1da30d7c37d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892038, "uuid": "9f9e499a-bd13-4c01-b7a6-525ea9df60af", "value": "97ca96f2e2ea15774cf85e5634b4dfe1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f198b5a7-57b8-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638921238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921238, "uuid": "424a83e9-a4aa-46aa-a299-8ad6d3b6ed70", "comment": "Malware payload", "value": "514221d9c93c6aa73b53d5480462afbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921238, "uuid": "6d25c4bc-6313-49d4-9243-82c08d93b6e3", "comment": "Malware payload", "value": "35d0aa54078701b31133573349243398e97fa27c57c058a86c738ba42e4f117c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921238, "uuid": "2707a9cd-b74a-44da-9d4d-e6b139262f40", "comment": "Malware payload", "value": "2bec234ac47d32065b2c9597be4191f396e019a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921238, "uuid": "fee67ac0-bc64-4435-b020-5de8b6206ea2", "comment": "Malware payload", "value": "9d97415cf1128eb9dedd908ebe4795a4292c2f9229e896349c01c1671e9c2e691ee1b98c7baa69290b42e25b4e9d45f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921238, "uuid": "e0390c75-55e3-45ff-b007-9cace56f5fdb", "value": "T101C4F11232C0D033D19325719526C7B59E7BB8315B6A5ACBBBC42A7D0F24BE1BB35319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921238, "uuid": "ab954897-a1c8-4e7c-9ced-3dbb137be994", "value": "6c355763d97257cce28120024c0d5f30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921238, "uuid": "1baeefb0-1a8a-4c38-9a38-2e51aec0a5b9", "value": "6144:Q3qIQeq8gLuVzpODhTtR1+YlmNeqKn47+2p9FMKhiqDHjSn9l43dbMHlW4qA5:Q3qI0LQp2nwRN7Kn4C2p9vhxCeNMbqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638921238, "uuid": "9fec7fd1-b2ca-4156-b1a9-e42d9c26f48d", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638921238, "uuid": "975ecb21-8674-4921-b9c9-a0db42631fef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921238, "uuid": "6f03f5f3-a313-45ba-b8ff-8caad18b83e9", "value": "https___cdn.discordapp.com_attachments_915626997240193048_917178395417280552_myfile_2021-12-06_01-06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91141097-573b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638867389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867389, "uuid": "a8c9d399-ce50-45fd-ad5d-6f8defe9100e", "comment": "Malware payload (Formbook)", "value": "cd0b582a026d0766d3c9278872eb43bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867389, "uuid": "9a87f277-2aea-45d1-a490-abd4664c05de", "comment": "Malware payload (Formbook)", "value": "3611aa8f5551099dd37616fc9183d02f08dd352eb1272616c40019d2b152050c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867389, "uuid": "5ede3373-e324-4a92-bebf-7a68aa994627", "comment": "Malware payload (Formbook)", "value": "fc0ea8f2b201703719577007973534b15a3e4738", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867389, "uuid": "aeccb664-5386-48d6-a6da-5d5133b070c5", "comment": "Malware payload (Formbook)", "value": "d4561d07fafc748ecf8a30efc807ccb7d414d417759ef8a60077ee936956f33c45a876ef98dd32da2099ad5c9c4da62f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867389, "uuid": "915a72c8-02b1-4ab5-88f2-02e361173591", "value": "T18455582C26B5085BE97D1A341425073B8EF26C3D997BE3CD3748356B4BB36840A257EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867389, "uuid": "a77a417c-6365-403e-8603-36b25f5e1f19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867389, "uuid": "e884cbcc-2f0f-4027-b0ae-12d938625dd5", "value": "24576:S7GtI9RLz3j/9Wq4mHhxK+EI+ValYffwOlGdKWXVz8C3Lj:SCeLlWq4gxPaNwOlNoVz13Lj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638867389, "uuid": "50372085-43ec-442b-bdd9-23121ffd0055", "value": 1286144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638867389, "uuid": "98583754-21d0-449a-80ca-cd1b40644166", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867389, "uuid": "19475e53-c9cd-4a75-b700-f403b13c0bfc", "value": "WANTED~0.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad80351-575f-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1638882947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882947, "uuid": "2e0cc58a-0bbc-42e5-b165-67e5e21c1c0b", "comment": "Malware payload (RaccoonStealer)", "value": "b57b6c5d8f1cb3f7ad5d492028b957ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882947, "uuid": "3251d0aa-1d5b-4508-b6cd-878e939f572d", "comment": "Malware payload (RaccoonStealer)", "value": "3637e86adb20ccee0c96ac838cbba3f61cc1ac0e27fa04766957f7ef28825461", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882947, "uuid": "f5cc06f5-7dc6-44b9-ac89-209491df8b39", "comment": "Malware payload (RaccoonStealer)", "value": "8ae7918611354ad85951080e6de324d3b1dc6325", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882947, "uuid": "f3432c37-9ff1-42da-ba04-213794a07cbd", "comment": "Malware payload (RaccoonStealer)", "value": "9a3a1fb299e794d8b29a69a4d6280f7f4c8a7ad96db3fce2959d5104202485e6683f5350172b1106e968c0a2c6ecd779", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882947, "uuid": "26b55e20-dbee-4b3d-863f-61d746c121ad", "value": "T17E1733563BC4D3FFEE49413B76C8B7AA0E7F858418B2A4D30A91C4B82395189F42DE57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882947, "uuid": "a9d5901a-a5b6-4e50-90e0-d287ef882b25", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882947, "uuid": "afa2274f-381c-4c36-b9c8-228d97245578", "value": "393216:xzdgoPPGhPdeem+oY+Db4s0Vq+qezSoZ70g34xB3OAPkuoSAo+Ou3y:5dgo2OeTv6b4s0IGZQxB3zPkFPo+Ou3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638882947, "uuid": "04a016b6-5f8c-442a-92ee-e7957ed51c74", "value": 18831671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638882947, "uuid": "ed51a4c5-022d-4074-9fb9-c024e062a3da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882947, "uuid": "452342f4-ae87-4608-b1d1-8dbcd7e67259", "value": "b57b6c5d8f1cb3f7ad5d492028b957ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56fbffd3-5797-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638906805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638906805, "uuid": "895459e1-2f6c-4598-9615-894402987ba5", "comment": "Malware payload (RedLineStealer)", "value": "23769393e13038a2f3d17e8ed876385d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638906805, "uuid": "9f027d19-fb15-41aa-a2d9-fc8c7b160cf1", "comment": "Malware payload (RedLineStealer)", "value": "3656fa0043bed282d6292af09ebea7233bc01496cf69728a816a9a233f76a766", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638906805, "uuid": "964be9c7-087e-449e-92e8-b8fabcdd318d", "comment": "Malware payload (RedLineStealer)", "value": "65d45f11053d122ae4167799e8e9d1efbc5d926d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638906805, "uuid": "3d5e189a-0a43-4a31-9439-78305fefe112", "comment": "Malware payload (RedLineStealer)", "value": "11329c55185a21dc2ed22f0eca2a577b057f686a7dbffd077dc7b970d6b8da338dbc51ec84262cc4b7f3691fa4a5e31e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638906805, "uuid": "c6a48085-a318-4a9c-b3c6-d783b0fba190", "value": "T11825EE4FEDC78655EBCA077945F3B7008B7754D90F2B4BCA9308A6E06BCC1603BA8956", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638906805, "uuid": "f9d16ef2-ca8c-4a23-ade9-3b54d6ae00c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638906805, "uuid": "da925858-f0e8-4a11-b073-7c4b952a3a3e", "value": "12288:yLjmG6dKu+hwGNrY43BFDNcZXZrYS/EgIqGNFEztVcsz/MGgeNbwAoTv1:g9NrY4xFDNrT7qyot64/pHNGb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638906805, "uuid": "2daa4bc3-d171-4b11-abd2-824dcab01213", "value": 1021320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638906805, "uuid": "d5f14c1c-8bd3-4cc0-af8b-12bb706e029a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638906805, "uuid": "2666c77b-2bbd-4036-8089-26538ba09fcd", "value": "23769393e13038a2f3d17e8ed876385d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038014fa-5772-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638890773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890773, "uuid": "f0cc78a4-528c-46a6-9ae9-b27ce8e5788f", "comment": "Malware payload (RedLineStealer)", "value": "38905b87a75c49e915918fbd8312e06d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890773, "uuid": "d831a368-b812-42bd-934e-5f89d8778bd4", "comment": "Malware payload (RedLineStealer)", "value": "3670a1a3f9b98f218f97ee02e83c32a2b8a93d72bade66618091ee7006e8a751", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890773, "uuid": "bb0bb7a2-ca54-42b5-a582-8fe6fee6b5fd", "comment": "Malware payload (RedLineStealer)", "value": "fc586b073020fb819460694072f20afd0e46fc41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890773, "uuid": "155c6982-f345-41a6-b47d-809535397623", "comment": "Malware payload (RedLineStealer)", "value": "a3ea0fc858cbd8920aa7f876f53c33c96cd497e40e058487794b5c1cea8f2633d1754931a96b41bba0f35ed9bf9bd9b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890773, "uuid": "4ce13c2c-50f6-4637-8043-57fb89df3ab8", "value": "T12A6533F348C4FEBFC7FD89B5BA5B84085386C9B191508783EF2B9996EE6114E0B540C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890773, "uuid": "f878ccef-c85d-4c66-8c7c-b7edc2088f59", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890773, "uuid": "fc6dae2b-7433-417a-b756-1a9dd4fa58b8", "value": "24576:zuEAGZqTXBTfR/8ZgW++zO4KlELMZ5uXhyRclWhWW9B75e6DkEaHNYK3wpehdzm:iE6T585Za4KlZOsRpWWPNaxdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638890773, "uuid": "f16810c3-7f48-4b27-97ce-5d4be0eda8f4", "value": 1472512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638890773, "uuid": "e08432f8-0b83-40ca-a0b0-ca472ea0442f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890773, "uuid": "958fb29c-0ddd-414b-9c66-ae793120bf13", "value": "38905b87a75c49e915918fbd8312e06d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9470c8f2-573d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638868253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868253, "uuid": "9ceb3b9f-5997-4524-97f8-6f51a42ea050", "comment": "Malware payload (Dridex)", "value": "cac10b5bb91b769e94549a44336963d1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868253, "uuid": "b1d14194-d92f-485f-a5c5-1f6c270ab51d", "comment": "Malware payload (Dridex)", "value": "36f37ae5d4b50030cb186ed6ff3b300cfc40d8db793c1a6b50af7ee0f6c4a0eb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868253, "uuid": "8eae519e-0a23-4f48-9aab-87d42fb1de39", "comment": "Malware payload (Dridex)", "value": "32c2e31c9f0c5448ce4b9f1bba0eb12780e1347d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868253, "uuid": "795dc8f1-a87c-49af-933e-84a9b166858c", "comment": "Malware payload (Dridex)", "value": "fafadc7c8d2e0c85f4f1290fa94e5d71e36e9ea91df129d1a38c4f41759245232221b094beda538b38f2be490890f7f2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638868253, "uuid": "f8e2c87c-e9c1-49d9-8f00-b632a632a9a2", "value": "T1992484D65EA6DCB0EB85C1708CCD37708625DC741E494383B268A33AFE2B5B89F84795", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638868253, "uuid": "9a0e466c-9415-4c4d-a62c-11f9910f5273", "value": "6144:N96FE76hr0d3n98AdwL3x2bVyyKC7A/Psd4MG0d9Ez:o0PM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638868253, "uuid": "b7250743-d639-4a22-a00d-095ac04071de", "value": 217600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638868253, "uuid": "c3fc0360-eeb1-4453-bbfa-6827682d1c89", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638868253, "uuid": "6984c790-32e4-4846-8d1b-b8e69172d595", "value": "act changes9577074707.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f210e45c-570e-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638848224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638848224, "uuid": "87b7612d-5982-4df1-8a2d-1e62b96b71c5", "comment": "Malware payload (RedLineStealer)", "value": "2fe7e5d4d13bd5f901d576f7b88337f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638848224, "uuid": "9281b2ba-eb22-40e9-b180-5863d3b66d70", "comment": "Malware payload (RedLineStealer)", "value": "37a69c08e620bc15bedc0b2d3288a621c6ced511017433d3b8e2e5bb7e2155d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638848224, "uuid": "78a74aab-bb89-4ce5-ad27-01b3959bda00", "comment": "Malware payload (RedLineStealer)", "value": "86a0fead363918823b1ce82b1de9ae13ec5bf014", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638848224, "uuid": "734155bd-29a1-413d-be1e-e6710ea670e9", "comment": "Malware payload (RedLineStealer)", "value": "594658cc1c11fbd89561c8034dcac6ffa987c8fc97cf2edef7c4296dfb175d7d7af35c10d0e2a7ee94f66bf28fb8f67d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638848224, "uuid": "29c7789d-0421-4ebf-a0c8-0cc509233c81", "value": "T16E647D10B7A0C435F1F712F84ABA9379B93E7AA16B7490CF12D516EA46346E0EC3075B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638848224, "uuid": "e9d54bc7-a5a2-45fc-8adb-6fb2c391c5cc", "value": "9a4fc332982336bed32e6b1dc80be347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638848224, "uuid": "8ef70be6-ddd7-4c43-b8a7-787226fca3f8", "value": "3072:0q0myqd0GY0GMB8brhMGW7evwgeY2V7JcYmCCGR6If1mj71Dy515EAYwxxUkLYqN:Y0G2i4LV7SYmcZf1mVDqLEAvrMq1nY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638848224, "uuid": "974dc225-554c-40de-9d64-7300da0ab6aa", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638848224, "uuid": "28a0dfd2-881d-42be-bb0e-023e0f238aa0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638848224, "uuid": "39a9cf65-5043-489c-9b8e-bb2b9f75de4d", "value": "2fe7e5d4d13bd5f901d576f7b88337f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55a1ad5c-574b-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1638874161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874161, "uuid": "1ea90558-19de-4ea8-84de-8fed108d1f89", "comment": "Malware payload (SnakeKeylogger)", "value": "0bc78923cd459f32b22143e218d36f9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874161, "uuid": "07e9b974-e40b-4d1d-a601-3e45d02bd8f7", "comment": "Malware payload (SnakeKeylogger)", "value": "38cf5f384013f4abee761fc5f076afbf41a44fc270d1fe2c4340dc0d1fa43e4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874161, "uuid": "c007c64e-5dfe-4a9a-93fc-9473d4d618f2", "comment": "Malware payload (SnakeKeylogger)", "value": "6277fdb6265e0910fc8ff723b1cc117d5c3a77c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874161, "uuid": "35a176a4-e10f-4b77-a66d-5126d51f9a7f", "comment": "Malware payload (SnakeKeylogger)", "value": "0648c138eee94bb47a4b9a85d0c49864be4da4a593e8aefabc3e91e5cc963715c53ed72b743f17f8ef1f8b69707626f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874161, "uuid": "bb612dcb-01ed-43f8-b0a0-28ff12dc81e4", "value": "T17815230622984B79FABE07B25050C46087BE9C19A723D3558DD17DCF327BB858983ADF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874161, "uuid": "842fa39a-95ae-4de9-b3fa-2c5893be5203", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874161, "uuid": "51a8eadc-d1f7-40b4-a0d2-3ce0e2672c1a", "value": "24576:mAuF5h5HkpGj7ciqiXLLEFDWeYCbkJYQ9qn2iAYak9g:m53h5HL7rnEFieYCccgpk9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638874161, "uuid": "9b4aced3-40cf-4a99-a281-9afe86e0f6dc", "value": 932864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638874161, "uuid": "0dc051c3-cdd9-4a69-909e-f14dc1b68d2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874161, "uuid": "504ca1c2-dc5c-4e4a-bbb3-98640f274865", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c99fa2c-5751-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638876723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876723, "uuid": "15a88e83-7c36-4865-b8b4-271eac2c9823", "comment": "Malware payload", "value": "e1f24e827fe14872df7fce40bbcbbd35", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876723, "uuid": "ba0cdfe6-9786-4997-b377-a6059c12861c", "comment": "Malware payload", "value": "390b2e4c089f28964617db439ed276304fe3e6a1a433b61a9ae3c1942676a57d", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876723, "uuid": "53d42066-9274-42f8-aad5-8ec61ef1d665", "comment": "Malware payload", "value": "97354e8b534abe7c659620d91bbfa493976de349", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876723, "uuid": "74f4a657-6924-4adb-9b24-ed6b330e55a2", "comment": "Malware payload", "value": "11f4b15d478ea2785569294425e8694727696b664924af655dc1537ce17f2a6d3ee672b43ef3f21c84a4ec2c59f8517f", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876723, "uuid": "4ea6b0b1-917e-4a3b-8a69-3c703f932593", "value": "T163341283B745F2EFCA82F7360EBAA012C965DF183633614CCE2F73635A7859801947A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876723, "uuid": "84153898-2b5d-40c9-912b-d41948f6abc1", "value": "6144:q6UELh8+6S6vANXolZ1BjUlOI4paq3ayb5gE:qhwS+6b8qZ1BjWXoqyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638876723, "uuid": "f1cfe619-3b68-4fd6-a63b-3714de4f9333", "value": 234680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638876723, "uuid": "d1422792-5800-4e9e-9776-6ed12fe76afe", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876723, "uuid": "f033dbb5-3f77-49ec-bcc4-c568c8f0db26", "value": "Order AMFNMF0810.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "446565cf-573b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638867260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867260, "uuid": "50f324ce-601a-4f12-b1a0-569225cdf9d1", "comment": "Malware payload (Heodo)", "value": "d7a6cf7b59e3e57e2d67efec413b7841", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867260, "uuid": "c62221ee-6c6d-457a-b140-be786d3c9bd7", "comment": "Malware payload (Heodo)", "value": "3abf08d0ab7e261ef78e74827d43424fce41bbf98ffef48994c6d17c86f172cc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867260, "uuid": "43eb1b3d-8a87-4684-911b-2d00cc095221", "comment": "Malware payload (Heodo)", "value": "088a2e1c986933f87698d154c5aa691512e83f96", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867260, "uuid": "6eb9756e-cccd-4b45-9d8a-c03e6fc69731", "comment": "Malware payload (Heodo)", "value": "5ebcd4b583bec72beb91c2236c70c34326d1a03060045e7f7aee3fadcec6c6ef9d60563df8e95424d777c711e610e897", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867260, "uuid": "c9aca7f7-ce6d-4aba-849d-ec8e0ca590ec", "value": "T15503C02DC6516588C323A83EC20884EAB05D3CA25041FD0F1594B78D6B7A5BB2BDF9FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867260, "uuid": "d39a0b27-55ac-4859-b058-74bc8c727c8a", "value": "768:Ab/Mvd5dhTJxmxE7l0VGpevZCw4VmUxjfC30+kS4QyoX0VyY5G:Abmd5zmxE7W0XYk4pEVyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638867260, "uuid": "8df325d3-f365-4907-99a8-9557df684318", "value": 38035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638867260, "uuid": "78007503-76f8-4404-be64-52280ff056e5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867260, "uuid": "276aab80-9731-4382-9cee-e20e5a0fb61e", "value": "GQVQ157777963337.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7827cb86-573d-11ec-96a4-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1638868206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868206, "uuid": "0de083f7-09d0-4805-a3d2-f446dd5c5859", "comment": "Malware payload (NanoCore)", "value": "d80c8d1caa0a4dc86edbc9a1054ed278", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868206, "uuid": "4442256d-b486-45dc-bca8-03cb42c20ebc", "comment": "Malware payload (NanoCore)", "value": "3cb8e1f4987579e9d3bd9a1063ed303a8817a514751b3e6043c0ae09e85dd03c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868206, "uuid": "46b1347d-dad5-4681-9665-ffcd7b7ce046", "comment": "Malware payload (NanoCore)", "value": "c692c18fc0c392de6af29a01df040ab61a67e79f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868206, "uuid": "af97e3d9-a664-4342-aa42-644023ac07bc", "comment": "Malware payload (NanoCore)", "value": "0053b66f94975d0278aad7a9909276d647fca3f84768a140a6e763d9b05e5fe07e17578dc5837a526a09731c91a77e7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638868206, "uuid": "972315a8-6868-4ebb-a044-1f9dca6648c5", "value": "T1DEC4E04435D5E2E9FC7FEBB80CB1B5C513B8F5D0E641F6EEED90215AA8A27910E005B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638868206, "uuid": "131299d3-48e3-4564-bc99-0d672aefb08d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638868206, "uuid": "c7bf62af-8e47-448d-8647-25e762e33757", "value": "12288:QY+2iNyZmBtW8qafloq6rBEnfEkyeeBZCBS:QY+1oEtgafqqnfD8ZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638868206, "uuid": "c466312a-d819-4847-917b-55cca2907120", "value": 546304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638868206, "uuid": "930cfec8-7317-4dbf-ae7a-3964f7593bac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638868206, "uuid": "e9209cf4-59bd-4b67-9c52-565c442c5903", "value": "9hNhQ1Em5mRIPMT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5111c808-5799-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638907654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907654, "uuid": "19db9ecd-1f65-4b46-90e2-659586e5e648", "comment": "Malware payload (Heodo)", "value": "5e49f42cdaa75ac2bf3f6317e9ce91a1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907654, "uuid": "2a97065b-f997-4a63-bb9d-1e1dfde6cc19", "comment": "Malware payload (Heodo)", "value": "3df0db3be205f365f3dedbeb2d021c6a4cb67e53e7558190b9ae65ae9956ba6f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907654, "uuid": "fe97047d-ec66-483d-a090-533b4a671546", "comment": "Malware payload (Heodo)", "value": "cb2366a52fbaacbc95584e80af0944d9db8088f3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907654, "uuid": "276ef74f-5040-47a0-ba75-0f917b9c7221", "comment": "Malware payload (Heodo)", "value": "598bc89d6b61c472e1a990da8f2c12808376ef7ee79dd2c7cf85c40c8a766bcce89e8c71496711da1f23b0e98ed6a474", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907654, "uuid": "51c171f0-6d8c-47f6-b6cd-5cdea6fef427", "value": "T1F855CF043D8180B6F92724391238B7658FEC69210B30C9DBEB94ED7D5E25DE25A3E1DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907654, "uuid": "8814debc-b306-4cce-b273-c08ae7c9f152", "value": "ce5896fd181bed8a87ce7f299693cafa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907654, "uuid": "35cc1085-a126-4b60-b1e3-2ce91e9dafe0", "value": "24576:a/eZY5g4b9/LwRMGS9sBS0EPG9RIOyp+PB9b12mehjfhfyxI+tORocluvCqknhWP:Nihwm98f9RvPXehKI+t6zyi17oN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638907654, "uuid": "281f2f3d-b2eb-406e-b637-fa2235a2540b", "value": 1355776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638907654, "uuid": "4ba4ba4a-be03-4653-b3a5-d600fa3992ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907654, "uuid": "a3a7ea87-9725-40c4-ac5e-4f3704f0a865", "value": "5e49f42cdaa75ac2bf3f6317e9ce91a1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4144a8aa-5717-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638851793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638851793, "uuid": "6c4ff193-12b0-462b-a0dd-d8faecf6dcbf", "comment": "Malware payload (RedLineStealer)", "value": "2c191cdfeca70a70d60b8ba2bfbc71fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638851793, "uuid": "57107560-4c39-472a-9e25-cab2a1c5d4c6", "comment": "Malware payload (RedLineStealer)", "value": "3e2324a1984b7bbd91cd330f430920aac22d48750048e6573b707848bc72bffd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638851793, "uuid": "300a9fca-d1b7-4bf5-872d-88637c1ebe52", "comment": "Malware payload (RedLineStealer)", "value": "b780cd3e534fbf10ace5948ee9bed0c85607fc60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638851793, "uuid": "289a74a4-127c-4215-aabc-b0142e62a78b", "comment": "Malware payload (RedLineStealer)", "value": "6a07261b13ef94cd57b325e9ba65500d4b82418e3054ed39fbfb1b9f694718574563dfb34236baeec31907713f18e416", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638851793, "uuid": "85b5d032-fadf-4b9b-bcc0-2aec905a83a8", "value": "T1AA648E10ABA0D435F5F312F84AB993B9B53E7AA16B7490CF12D516EE46346E0EC3071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638851793, "uuid": "d08af261-894d-467c-9b1e-a90a3c6f162a", "value": "9a4fc332982336bed32e6b1dc80be347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638851793, "uuid": "a4430be0-a0df-41c9-b7d2-2af987332b50", "value": "6144:7Whk0p8bdi6qxbxd272ON1m4diuEPpRKD9N3Pmhu6E:7Whk0p8bdUxbxd272ON84dERKD9UE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638851793, "uuid": "85e40925-e2a4-4670-8aa1-5511f9ea3db4", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638851793, "uuid": "1d30d28c-59bf-4af3-9985-195f05c4fc08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638851793, "uuid": "9d17404e-d3b5-469d-825e-8b7758eae1a2", "value": "2c191cdfeca70a70d60b8ba2bfbc71fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7f79ba-5745-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638871869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638871869, "uuid": "a2369911-98a3-4f4e-9065-cd06a5cdd9e8", "comment": "Malware payload (Heodo)", "value": "43535c1f603654f9503f5095a8d3d639", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638871869, "uuid": "efeee94c-2b67-4f25-9ddc-cd54acde7ff5", "comment": "Malware payload (Heodo)", "value": "3f0818f432853b65fd5b789946c36af8b773ad61dab06891f95c643c526c3450", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638871869, "uuid": "be930cff-6d7a-45fc-a940-da551034f240", "comment": "Malware payload (Heodo)", "value": "e46aa47ef461bae4572cbcb55379b4b289afae39", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638871869, "uuid": "e46f5991-9cd2-4b4b-8f03-a181b67a73c7", "comment": "Malware payload (Heodo)", "value": "b883289b7044f424ee7fb9aa1c2c09d1f4641245490ebf48ee86bc67f17c0d2b52eb0d447a0776e21d83444b5e9028ef", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638871869, "uuid": "8ae7ad5e-adcf-442b-8578-0791a4f5c981", "value": "T15EF48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638871869, "uuid": "aceb215e-bdac-4cf2-9864-01cd31bfb408", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638871869, "uuid": "7f2dcf42-8d2b-4c23-858e-1f7d2149e56b", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/X:JapiKiBEmj4GbOX399Md9J/0TV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638871869, "uuid": "3f2d64a0-1328-4b5e-83a8-46be025d79b4", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638871869, "uuid": "d851e061-8d49-4396-ba65-cbedc2395253", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638871869, "uuid": "b0761907-4e91-4a1d-b88d-0e9958a01e14", "value": "DLgijtCfLo1Ow.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32f80b1-5785-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1638899229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899229, "uuid": "507e1db0-ad7e-4c21-a290-a06cf0062c80", "comment": "Malware payload (SnakeKeylogger)", "value": "7dd3654a64ae8c4b4a1b34376ca00e97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899229, "uuid": "3e4f0b1a-65e4-49ef-8b61-1afa39366016", "comment": "Malware payload (SnakeKeylogger)", "value": "3f21db9d14aeead42447a3da72e51971ff0eaf006919824b02416bc0943ad551", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899229, "uuid": "b546cb7d-083c-4dff-b1ae-8802673b7e55", "comment": "Malware payload (SnakeKeylogger)", "value": "cf22f0375784b414f4ffd3c8044d7d9aad0c78da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899229, "uuid": "bc4298cf-6c2c-46e0-811b-3899d72dd7ad", "comment": "Malware payload (SnakeKeylogger)", "value": "1bd5ca529c5250c6ed57fe24188e3646fc231f9ad445a98961278c8d6ca07d8c646adb693d241c7093acbfe77a027fb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899229, "uuid": "8bdb3ee6-b435-4552-8abf-3db2c0f88bb8", "value": "T15B25227C3243E2DEE85287F2376A90B8A1756C32150BD198D85E32DF2937784B673B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899229, "uuid": "b5938081-228c-4d0a-bcc0-fe3baf7a0a17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899229, "uuid": "44b7d0f5-33e4-4ee0-917b-f3ac906dfff9", "value": "24576:XeMRG6kyVBtzPqDa45rZeWmnmL+1HaVDYHis5mNkz:NA6DvtzPqDfZ4yL+1SYf5mN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638899229, "uuid": "71306ebd-9835-4868-898a-94236ee3b7e3", "value": 993280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638899229, "uuid": "7b542cfa-f193-41a2-b091-3433ff5677d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899229, "uuid": "01516edc-12f2-4c87-8b8c-edfd15a7e6a6", "value": "Dekont Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2b16a9f-5743-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638870988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638870988, "uuid": "40d6a78d-d86c-41bc-bea6-0638064f92fb", "comment": "Malware payload", "value": "eac88bf0b837ee1ff659018954ce5760", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638870988, "uuid": "0e55ebed-834a-442c-a440-fc4c4948fc93", "comment": "Malware payload", "value": "42c2c1abcb8a73717c240bf0905f22fc802740bb2e6a4f022019ce63d14f33cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638870988, "uuid": "990f9a6f-7dd3-4c81-ad34-a0aacf08270b", "comment": "Malware payload", "value": "2b972d9ae83a30b84e4480cf34176d0239b382f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638870988, "uuid": "8ab92c35-c885-4850-8d29-24cc5a958187", "comment": "Malware payload", "value": "fe2d9d8b50a2874e8e4b029b13635e77e89fb60510b432628589f8a663d5deaafbd3076de6bda04362ea3bca2f17bb67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638870988, "uuid": "7c8145dc-512b-431e-8ee2-7b9e3a7751d6", "value": "T17C85AFCEEB8294B7C56B0AB045DBD77A2330D938805F4F576A9DCD78B813990BD0EA05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638870988, "uuid": "20d1476a-623f-4cc0-b9d4-1351a95da945", "value": "49152:buShxqhBDh3hSjrlp/P5EiXT3fRHIrLyZB5Ss5+Nu:SShxqhBDh3hErXX5EwKPyZB5Ss5+Nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638870988, "uuid": "1a2d32e6-fa13-4a56-a688-f9e902d88f70", "value": 1870048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638870988, "uuid": "60706a3f-05ae-40b7-bb77-a70ed16d723b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638870988, "uuid": "7238a6e6-5c8b-459f-ac10-3d597ce2d861", "value": "42c2c1abcb8a73717c240bf0905f22fc802740bb2e6a4f022019ce63d14f33cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9867e961-5762-11ec-96a4-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1638884151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884151, "uuid": "366454b5-b4b9-4555-b5aa-9c9d8694f2df", "comment": "Malware payload (TrickBot)", "value": "800013ca00700ebc08533c02d3be3fe8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884151, "uuid": "21f6af97-237e-45be-abae-f459a237ed48", "comment": "Malware payload (TrickBot)", "value": "435e34ae36e41d9bc0bc9ae051ef42c21721a826daa55d243eec6c007b8bcb35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884151, "uuid": "e8700dce-7237-4b25-811c-67b88491c9ed", "comment": "Malware payload (TrickBot)", "value": "f705626b2c7e8ba2b7d7250f9203df5db96e06ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884151, "uuid": "4b2aadb5-1510-4d47-bf84-b8dcb9e8afe7", "comment": "Malware payload (TrickBot)", "value": "fdbf01111977a92a330c9d1878650577f28b05c950c4d35c3923f5681adc4517141c12c84ce927013d4caa352822cfc3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884151, "uuid": "e59c5071-d59c-4ff0-bd2e-f683fe455035", "value": "T1E38523DCF79B3AC311755DB349B535A665021E328993C8F6EB59330B01285AC2FD0EDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884151, "uuid": "e65b4ab1-a490-4163-8293-f1ed7a8ebf13", "value": "09c580845f46bb441d6a2caf033b503f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884151, "uuid": "028efe96-5bbf-42c9-8a4d-4cbd3d748e06", "value": "1536:b9U0ziL9V7ddRdBmbXqBBVgjE2KDZYoQbdjaCWM4pR+R9O2qGTw9uA2YDcnHIxVX:5ELrZdbUia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638884151, "uuid": "1a5add91-82c3-4489-968d-081752813908", "value": 1747968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638884151, "uuid": "b50fbd10-accb-4558-9369-1d941a7cbbfb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884151, "uuid": "c8729f40-b238-4621-b49a-98b5fdfe4a3d", "value": "800013ca00700ebc08533c02d3be3fe8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef1bf05-5736-11ec-96a4-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1638865023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638865023, "uuid": "0f536fae-d10c-4440-8dd6-b3841e15dd44", "comment": "Malware payload (CoinMiner)", "value": "938150f91d742c07236f8bf8c4823028", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638865023, "uuid": "6aae8903-9d43-402e-bdfd-c3065af6c003", "comment": "Malware payload (CoinMiner)", "value": "43a76564e07435ac07f3d3d3ab49885bd0bf8562d0c14a87fc2d536d4c94b62b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638865023, "uuid": "8de43045-abe9-4f6a-8987-ffc3ed1b00f2", "comment": "Malware payload (CoinMiner)", "value": "9a375e941eb880f0f8be3d8cef2e149b74df140b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638865023, "uuid": "731b9ec1-59ba-4a83-85c9-656265cf2ee5", "comment": "Malware payload (CoinMiner)", "value": "145b627afa81a443a988c89301a1ac8c794c346dc46a6049f6fef49bdfb783e22df751a4312426c4a674c3872a7c2285", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638865023, "uuid": "72ad06c1-5ba4-416b-90f9-7143a2128287", "value": "T16665CF9672E0C1A7E093463195AFDBB6EBB3B811321541133B603FAF3D35283642A757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638865023, "uuid": "f8d25add-8d8c-4ece-a3b6-8fb32288a0c6", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638865023, "uuid": "6b60d5e1-13d4-43f5-9880-be7f61f0d887", "value": "24576:YavAavAavAavAavAavAavAavAavAavAavAavAavAav:YeAeAeAeAeAeAeAeAeAeAeAeAeAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638865023, "uuid": "9a3f4463-e3e6-46bb-8c1f-18f3b8f326a7", "value": 1490944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638865023, "uuid": "dc63b266-71ce-47f2-89a7-3a241ee0ddbb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638865023, "uuid": "953f5b70-1939-46d5-bec1-e0040390181b", "value": "43a76564e07435ac07f3d3d3ab49885bd0bf8562d0c14a87fc2d536d4c94b62b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b8ad97-56f2-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638836152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638836152, "uuid": "e5a7958a-e7c6-4586-8794-25d7f35d7cef", "comment": "Malware payload (Loki)", "value": "3f22a041fe7e94d7147c2a328a09129b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638836152, "uuid": "6904a12a-d1ef-4745-b42f-e7c31578e649", "comment": "Malware payload (Loki)", "value": "4416b3d0dd3d1d8566cfb279b45c4f1ec653de8f5a133f9e85e755693eb88d8b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638836152, "uuid": "6457eb89-afb5-4f8e-b17b-33d1992b8477", "comment": "Malware payload (Loki)", "value": "68ddeba66cc412548445a9b1ce693ebd0f6ca936", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638836152, "uuid": "45c6faf3-7f7c-4173-aed3-7391e4f27699", "comment": "Malware payload (Loki)", "value": "af0f8dbddccf962344b5c1ae9dc858cd11db7d54f3125a6680b506b457e82aff9f6244e1e75e4325987989a34f5b62e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638836152, "uuid": "ddfabe6c-da02-478c-a1ad-9a992b735cf0", "value": "T17074231F3AD04C6FEEDA62B138B2E57EB775D6E414894A135B405F1E3EA248A0C0712B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638836152, "uuid": "1dde2a43-1d10-469d-a8ce-44b0226e54e4", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638836152, "uuid": "d74642b5-31b9-4f4b-9bf2-484b5b96af46", "value": "6144:rGisiAf+SQmhVQlJmDUlIp+zGmC2jGpKHAjjRrOilmBy8FPRzqbwSshna/sbnb:paFQmhzQlIp+KmC2jGMH6VScmJPRz/pN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638836152, "uuid": "e5f9ba32-ed04-47cd-a4ad-2d58d1824914", "value": 357383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638836152, "uuid": "9d63aa3a-d487-4fc4-ae32-251a76982d98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638836152, "uuid": "90650263-7990-4557-a2dd-7ab6f0255939", "value": "3f22a041fe7e94d7147c2a328a09129b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a70daa7-5747-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638872397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872397, "uuid": "09a16751-6d8f-4687-82d1-be57e6eff096", "comment": "Malware payload (Formbook)", "value": "4a8755a179f5abf3f771bff3864fc215", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872397, "uuid": "b2d208f3-e834-43e3-9aab-1727082793b5", "comment": "Malware payload (Formbook)", "value": "45a2b6f890cfeca1f8288541f1bd9da42a7d7546d70df68894af590143fb1b4d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872397, "uuid": "0cdb29af-c7d5-48f3-a943-0123607eb868", "comment": "Malware payload (Formbook)", "value": "26a5a0c4000aa51da8e64456b6e49e0885a29c1d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872397, "uuid": "d3234db1-4702-4043-83ce-c543122092da", "comment": "Malware payload (Formbook)", "value": "400f8ac799ad93607c582b18979ffa26bc659510664d572759ff30677c628ed0ab8a57843f55c2cd449a278bd2b6004e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638872397, "uuid": "a3ccbfb7-4bdb-4adb-a5fd-cdd9f35c009a", "value": "T1371523B317EF6B29533616190E2B984D4E7B60A9B4D404FB03E3CCD86DD21F4D9258AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638872397, "uuid": "d98c32da-c9ba-4534-b99e-138ab3de4a77", "value": "12288:LK1w7p6tYsDUnpbO1zSnMDWeDHGO7Y0XDAbf3TX9WCzYgOuy0/4Q9cBnp:+w70tYsQngdWwGn7f3bRzfhv4QC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638872397, "uuid": "4d9867d6-ef24-4fb7-b4cd-47f3bf1827ec", "value": 931338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638872397, "uuid": "4c7c37df-94e4-4734-8d73-dd34d5caf3c9", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638872397, "uuid": "e8f8d97a-5b93-4c1d-9d1f-63c8af25bd02", "value": "E-dekont Ziraat Bankas\u0131.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ca53ba-5765-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638885377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638885377, "uuid": "4cea7fe0-c816-407d-8bde-366231ff5f05", "comment": "Malware payload (RedLineStealer)", "value": "00e4d944df1a04c75c6a3df489b412bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638885377, "uuid": "fadca64c-aa46-40c6-82d7-bb1221fc5daa", "comment": "Malware payload (RedLineStealer)", "value": "461867a89a672e53e8d6704c5fdf8b8cca3ea3efe5937f1eba7fdf3d0f67f282", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638885377, "uuid": "50763747-c0fa-4caf-a41a-5fb3ac1180b1", "comment": "Malware payload (RedLineStealer)", "value": "862a85be29a23061fbfd7dfb925310f5bd2bef43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638885377, "uuid": "9e05023b-3bf9-4d8e-8694-6f08d28a0f37", "comment": "Malware payload (RedLineStealer)", "value": "072cfc1e45106070f9acfbfb5d55ca46b77182d985a71b2ae8ee6c5bcca9646d79fbe4e80a7fd95353791d604c46708d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638885377, "uuid": "256e90df-9c33-4300-8d32-314e0e034fd0", "value": "T175648E1066A0D435F5F712F85ABAA369B93F7AA16B3490CF12D417EA16349E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638885377, "uuid": "6a00fe35-72c9-48fa-87ad-29dfe2a3616a", "value": "b5d39f822cf46cb1cac0e9a27db40014", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638885377, "uuid": "069ff1d5-bd13-4a4b-8a99-adc6ddc94e88", "value": "6144:BCq3FlVE+6hSU6U1Ct3F9vssCWHvb+oggsWJG:c+nCSU6ECt3F9UsCWD+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638885377, "uuid": "dcbc7ad6-6bab-44b0-a546-28ef57073490", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638885377, "uuid": "9bd60e2c-2fd0-4774-8699-2cbe9d3e47f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638885377, "uuid": "8803fc31-fc10-4658-9cce-363dd6925d5d", "value": "00e4d944df1a04c75c6a3df489b412bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5d2a88-5704-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1638843951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638843951, "uuid": "1fee6762-148e-4bf2-9e2e-5de88f4e6cfc", "comment": "Malware payload (RaccoonStealer)", "value": "a2e798b4ef4bd02947d4719aab57a296", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638843951, "uuid": "c9434103-10a3-43f5-b529-5231c3743fc9", "comment": "Malware payload (RaccoonStealer)", "value": "4666b3a3039e2dc192d56d4ae00d1935e6b3749e05a7e6cc0342414cea8b546f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638843951, "uuid": "59c66692-d03f-4c6a-a1e2-2e0b449cbd68", "comment": "Malware payload (RaccoonStealer)", "value": "14e6de85ad742a3482aca940170482e9d6c9e535", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638843951, "uuid": "c5808361-d7de-452b-bca2-620fc58d2cd7", "comment": "Malware payload (RaccoonStealer)", "value": "29317c737408fcc1dd01206d2fb8f16682b957147f30e933029dc474b194d6a46e1312170281940174d906bfd035920a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638843951, "uuid": "d4267d10-81ba-4996-bf4a-4eb9c10d90ee", "value": "T1ED648E10A7E0C435F5F712F84AB993B8A53EBAA16B3490CF52D516EE5634AE0EC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638843951, "uuid": "8e65b4db-44a0-4fa7-b0f7-eb165c2edf6b", "value": "9a4fc332982336bed32e6b1dc80be347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638843951, "uuid": "7a6255a1-1b39-4499-b818-4dffdb642300", "value": "6144:A6ZJ31JkVr84oQpzqiRNW7V+d1mqNiuEv5hZoWtF1:A6ZJ3fkVr8IpzqiRNW7V+d8qNUhZoWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638843951, "uuid": "eab737ce-0bd6-441d-b0bd-3c40e4ff79fa", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638843951, "uuid": "f5498c43-2657-4d46-9593-c62c93212f38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638843951, "uuid": "2b1e2504-8620-4d4e-b412-82f011054b02", "value": "a2e798b4ef4bd02947d4719aab57a296.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c3264e6-5786-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638899405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899405, "uuid": "e189b8bf-9801-4fd0-8931-8f2145f8aa39", "comment": "Malware payload (Mirai)", "value": "fcfc95d9159dd873822d16d8f02f5b35", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899405, "uuid": "fa67ccb8-bd20-4770-a09b-3f527bf12afa", "comment": "Malware payload (Mirai)", "value": "46d448e716fdd1b375cf1cee4ea34a96f2a55d68b76c443e28d46a66acf6b070", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899405, "uuid": "21d0574a-9d12-447c-a469-dfbd69855299", "comment": "Malware payload (Mirai)", "value": "4679fcd584d6ed7d75c2e9e543dca2caadfc5ca6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899405, "uuid": "d92bf16f-380b-483e-a397-a382965d0855", "comment": "Malware payload (Mirai)", "value": "095bcd55b7bc6ecfe0fa69e4e2914f9d9b4c287b30569771650f29c198ace09674f95641754b1ef2a74a1263a825c158", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899405, "uuid": "48c4e881-2c2e-4727-aca0-8ec5c6edb48e", "value": "T15C333AC5D997DDF8E8201A793077AF3296B7E13E2128E9C3D3999937A942A03D10724D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899405, "uuid": "9022b8d5-5d46-460a-a39f-d15038c171a9", "value": "1536:PS+dEczOjRC6qf1dhWphmEBF19/MEgnNxg+kC:bOjRC6qf1dhWphmEBF1FMEGN+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638899405, "uuid": "61905f35-49e3-4dfc-8e88-80c8a1010f62", "value": 53852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638899405, "uuid": "f0dc694b-4dab-45d0-ae4a-8904ca5cab13", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899405, "uuid": "773e83fe-ae36-422c-927b-3e412c4cc7c0", "value": "kwari.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c983cd-573b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638867234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867234, "uuid": "19f05ee6-f08d-4911-abcd-e3596f6ba233", "comment": "Malware payload (Heodo)", "value": "cb5af7abe4c52b31a19087e974360340", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867234, "uuid": "074890b3-5b29-4ebb-8684-a3574114fd26", "comment": "Malware payload (Heodo)", "value": "471c8e2b2ca763f492c622da41259379490e7d7f9736239de5b883d0b675e9a9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867234, "uuid": "d9fa2fd4-f788-48f3-b07a-1637d6fc30ba", "comment": "Malware payload (Heodo)", "value": "61c6e6666dc49cd625bc5e3ab31710b3e8660aed", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867234, "uuid": "401ba00b-adce-4a35-8791-1556bd2297e3", "comment": "Malware payload (Heodo)", "value": "41accec0e6a9507ab17687dd5844abc8f51216553a89984f3d4c317677f9ed3b422a25a42fa6558328ad67b1fafb8c03", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867234, "uuid": "e1468d8f-0265-4d67-b14b-a03bc0e31a9c", "value": "T1E703C02DC6516588C323A83EC20884EAB05D3CA25041FD0F1594B78D6B7A5BB2BDF9FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867234, "uuid": "c42170ca-c018-4a06-9641-e149fa36ed06", "value": "768:Eb/Mvd5dhTJxmxE7l0VGpevZCw4VmUxjfC30+kS4QyoX0VyY5G:Ebmd5zmxE7W0XYk4pEVyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638867234, "uuid": "5543b409-0eaf-47e0-84cf-ef0a9f2b58bd", "value": 38035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638867234, "uuid": "cc3ee74b-216d-45ea-8aa8-4b37b9b03619", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867234, "uuid": "7a060715-48f7-4fc8-9c0f-1671bcee562d", "value": "53317858809.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c35d0606-5755-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638878640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878640, "uuid": "72a7d85c-6900-4d9b-ad25-a10de3d69b19", "comment": "Malware payload (Mirai)", "value": "b7a389f84b0198c9dab9a1f8cb7d713f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878640, "uuid": "78544d56-f2ac-41f8-bfb5-dad5339c381d", "comment": "Malware payload (Mirai)", "value": "479fa95f671f192cc615cd0f3e08fe261a4e76c16fd29985903039ec08e9134d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878640, "uuid": "65896518-7eb2-41c6-a3ee-a060c3934b3d", "comment": "Malware payload (Mirai)", "value": "de94975dfe3b8e1781eeac059ab55250ec0b287b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878640, "uuid": "0ae2d7bb-e6b6-4819-903b-c021bc6501fb", "comment": "Malware payload (Mirai)", "value": "a09a325155cb660affef5a21697a68c6b840a4b15202e5b01f38b66f8150bd92d3a6e868b46da400d1432e920189d675", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638878640, "uuid": "50300925-bbfe-4d2c-a955-8729005e3145", "value": "T17DD36D46EA818F03C4D5277ABAAF41453333A754D3DB730699285FB83F86B6E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638878640, "uuid": "beada1a7-f69c-4734-b7e5-5090b838506f", "value": "3072:yvMz9uDxVD5qYXRNZSIEEmWUsDR65MN5hX1O3M/9mDNn:SMz9ulVDLSEmWUsl6uX1SM/9mDNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638878640, "uuid": "d100d5a4-5fb7-44a8-819b-77fb0c85206c", "value": 135333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638878640, "uuid": "07594491-2fb3-4d60-aa36-3960669ede30", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638878640, "uuid": "2b3494c3-0ea3-4e18-b5e6-a8d11882b194", "value": "b7a389f84b0198c9dab9a1f8cb7d713f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce3c1a38-5748-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638873075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873075, "uuid": "28c7e819-5c30-4602-82fb-4300d64814c7", "comment": "Malware payload (AgentTesla)", "value": "8988fd3e160889e1d44d6e9c237c803a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873075, "uuid": "aaa8ff27-e009-4021-9103-0de411a93405", "comment": "Malware payload (AgentTesla)", "value": "47fc87897b349ab521af244b8ef31fa25d31adfd92f6b1b66ec0e3eea53ff22f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873075, "uuid": "22d8ef3c-b5ac-45bc-9952-89bf96d461a0", "comment": "Malware payload (AgentTesla)", "value": "cc39d935c647a1b070d2467a78c337d368120c72", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873075, "uuid": "c2e7a7bf-e4c6-4bde-a62b-4728ed99be54", "comment": "Malware payload (AgentTesla)", "value": "d753555086e4ebd42fb9087d3555910748f8c2e3cae1e97e662dadb3e08ed64971b4add6bfe727e3d9258dd94f8e76c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873075, "uuid": "18371774-35c1-4154-b522-4d0e8e7f342f", "value": "T1D4E4CF8D3590B1EEF877D5729EB82CA4EA20B4F6D30B519BE013149ED85D987CF241B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873075, "uuid": "9abe5cd2-fda7-444b-8f4b-6d5e330f5ad3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873075, "uuid": "4b0bc634-99db-4c0d-8472-ebff43aa55e6", "value": "12288:FQYSKB2wB1SIjUx5rXgzyMbyGD7MjQh+48fMGLzjlvvOIcuZRvjUbilnnwCTCwmz:FRS8B19onfrjlMuvjDthTCwmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638873075, "uuid": "779d3900-6e00-4e55-9dd0-6e87f70d6d50", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638873075, "uuid": "a44cf918-6991-4b01-a4f9-c2ea63f28e49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873075, "uuid": "b39ec727-5095-4097-bc9b-593eb2bdbd89", "value": "Thorold Auto Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3a26ca-5755-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638878571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878571, "uuid": "c2ce726b-a32c-4ce9-9d75-4ad0473bff4d", "comment": "Malware payload (AgentTesla)", "value": "a3bbc29e73fbee588e87bb57f58db1c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878571, "uuid": "fa0fbc94-912d-4b8e-ac4f-2f39d9c0ead9", "comment": "Malware payload (AgentTesla)", "value": "48181538ab75c86786e9cf8cfc336f40f4ca0a205c213e11285bf994bfba8e77", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878571, "uuid": "6bfb3715-c1a2-40a5-a9b3-e21eee0c0b44", "comment": "Malware payload (AgentTesla)", "value": "5bae1928b5c22ac6626e755d8a63e74ed666f9d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878571, "uuid": "af87fac9-5570-48ea-9bd1-0958aed6c4df", "comment": "Malware payload (AgentTesla)", "value": "1ab461ea7a646f42db120d0bf0887f34dd5421db3550356a84320c16fe9e1276c285cb1b1e4f1f89413bcc4a75490996", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638878571, "uuid": "3dd70d8f-f2fa-4c4b-99fd-0c041d48d671", "value": "T1C86597995A929AFBB5705BB102673AB7F3D70ACB3B34128115501D34D874BCEBC6FA02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638878571, "uuid": "b44c94e4-e1dd-4d1d-afb2-298077818b52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638878571, "uuid": "8f1885bf-bef3-4c8e-8b06-bd4e197762e0", "value": "12288:3hIE1Q5aFlvVYvEQhyhK9vCWGG3o34lSTDSRX0ZYA:l1Q5LwoGlU4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638878571, "uuid": "63728edc-6eb4-4947-be7b-34d98b6dc635", "value": 1521152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638878571, "uuid": "8a7ccb71-ecde-40e8-b3a2-3f02f5b5260c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638878571, "uuid": "4d8f9035-a1dd-4cb4-b115-0415d9087b9c", "value": "Rechnung.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a5f537-5759-11ec-96a4-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1638880258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880258, "uuid": "6de8b232-7ec9-44b4-9ea6-5ab303a3d911", "comment": "Malware payload (TrickBot)", "value": "11bfd08656a756e6c27243502f178276", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880258, "uuid": "212023eb-a61c-4f2e-aca0-e2005a108706", "comment": "Malware payload (TrickBot)", "value": "48d6dd14a8dfe178a89ba9e2dd6de426581d51bf6009b53d125257827404eafc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880258, "uuid": "f229269b-242c-4141-b608-7e44f45ea41a", "comment": "Malware payload (TrickBot)", "value": "4399d8d270a01d623b93214e1c821eea5351d02e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880258, "uuid": "d100d785-3f36-4004-8f32-95fa97eaba8d", "comment": "Malware payload (TrickBot)", "value": "66d99eac9ca2f6d07aea66bac5529285f29e9aeb637830122b44429941d846fa4476191409560ebc597e5d5ba961fa74", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880258, "uuid": "42295469-f671-4b24-9792-1396140e407b", "value": "T1E0852341F513F1099D28CEBE3D62BCC8BC954CA6E872423D4FBA133990B667A259D077", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880258, "uuid": "2250eee6-30d1-4747-a946-ea6c81025aee", "value": "41ff3531397ff529a9903a3f9352fbb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880258, "uuid": "6ca086af-87cf-46e4-93f3-4ee437d3dcbc", "value": "1536:bHsZePiJlBAOF7aOds8hZ9HM6ZQZC1bxBdsvg8+DdLW2cnDC525qAFdhz3mnpkV9:IgGxF+r8j9nmU1/d6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638880258, "uuid": "e9843522-8afe-409f-8a44-58897963a7ec", "value": 1784832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638880258, "uuid": "673aeb83-5e17-4261-a0f8-8dd826146207", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880258, "uuid": "e5a8a94a-c2fb-4668-ba4d-c7aaf293c053", "value": "roben.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a5faba-56f1-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638835593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835593, "uuid": "b510de60-280f-461b-9475-6dcd2be8f773", "comment": "Malware payload (Heodo)", "value": "747982e0e1f0497dac14aad836ce22a0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835593, "uuid": "8dd60e21-3e08-477f-814a-72a640a331d4", "comment": "Malware payload (Heodo)", "value": "49c587d90ed42766a90692942d85aff10fe458ef818abb1d30c5d145b19bee62", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835593, "uuid": "de2f9447-ba1b-451c-a434-7765b9b79948", "comment": "Malware payload (Heodo)", "value": "4aa61ebff12b8e1a1d2ca8eea34dc131ef3caeb4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835593, "uuid": "17610aab-7247-4129-ab11-3a8ee9557cc4", "comment": "Malware payload (Heodo)", "value": "c538c244502f324a8662fba069d84a29f14aa0fe4b22cb9b7838ea19fb82746b7f7bd6f0afb62f900fc3d8c5554bb6e6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835593, "uuid": "dc2a8163-31ee-488c-ad57-f72528481f7a", "value": "T127F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835593, "uuid": "e0dd0b0b-960a-4621-8a76-35873f84634c", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835593, "uuid": "d8442f51-30ee-4926-a457-8265f00d99c2", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/r:JapiKiBEmj4GbOX399Md9J/0Tx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638835593, "uuid": "f29029f2-fe79-4590-a5ab-fbedb1635d04", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638835593, "uuid": "3ad9f155-6881-4dfc-b3e2-0776f769141a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835593, "uuid": "4878e09c-cfef-47ab-b426-e5b33b034f72", "value": "emotet_exe_e5_49c587d90ed42766a90692942d85aff10fe458ef818abb1d30c5d145b19bee62_2021-12-07__000627.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e9d2572-57b5-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638919729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638919729, "uuid": "7cfc4106-03ee-4c5c-823c-646370b00b2e", "comment": "Malware payload", "value": "e213401158fcd632f758cd8bda224c7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638919729, "uuid": "33d88ad4-f87d-4c5a-9e3e-c806dabc024a", "comment": "Malware payload", "value": "4a5f37ff394af7a750b1933c3e77b927043e933bfa715c917c824fbc645c940c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638919729, "uuid": "985535b0-05fc-477e-b979-fd0a7b9454a2", "comment": "Malware payload", "value": "407852c802d47e368f8e92a14c3b107eb34ec68b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638919729, "uuid": "e797d50a-b484-4ec6-ad6f-01a095d34e8b", "comment": "Malware payload", "value": "c545e9349067baef36b2e479d1936806c2dd7428d5241e1fd627cb1165216c18bf472f463f5f263cc9595dfd80c9df04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638919729, "uuid": "a4c042b6-432a-4b0f-9ac3-6287f292860d", "value": "T154948D78AB5808E5C7EAD776456B39F4637332D30AC39E9D019D73C20E2B3626F59A04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638919729, "uuid": "2a248211-d7a3-4e64-9d93-b53c6540e947", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638919729, "uuid": "4cecaef1-fa87-4444-a801-75db52a180f0", "value": "12288:u/7JaU00nZM7ct5bfWf59PbHRE0QKQpq5XN+46YCAj:uDJznZ2cTbSrO0QKQpq5XNOAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638919729, "uuid": "6d357799-8627-42c5-b0a5-14e198878e2d", "value": 421376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638919729, "uuid": "bbb83917-ac17-4943-b044-d4e9145329a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638919729, "uuid": "8dde1456-dded-44dc-879a-a51ba09df8b2", "value": "resource.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0da9193-57a5-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638912995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912995, "uuid": "87e12a3e-6809-4133-8af2-b4437772d516", "comment": "Malware payload", "value": "6da5c4e5ecd7550dfd105e0aed822dbf", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912995, "uuid": "7c08162b-1186-4413-ad7d-5b3937d4467f", "comment": "Malware payload", "value": "4aa281c6840591127f3e01d89f0c5da4e17fb46132486a871c989c5025f04cac", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912995, "uuid": "9340a55b-2f5f-4e53-9c54-a0d22efa10ed", "comment": "Malware payload", "value": "18b28535113c0b0506e7e3e641fad46f8ff1f576", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912995, "uuid": "799df681-f1b5-4165-a035-b3ce9d2a714c", "comment": "Malware payload", "value": "583c4f9024dffecae456a6d25d9710ad081898622660c1f4eaddf880cfbafea4dd234dc522e9779656cce42b97405b96", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912995, "uuid": "7d2af930-9c40-46a8-b356-80faaf8224ba", "value": "T100A5338BD68515D8D2428731D3930DD37C563F92A18AD8FFB27F35193361AA42F9C2A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912995, "uuid": "d6a8e899-9850-468b-b7c9-003bff601fee", "value": "49152:/EfByVLZRmnmZ8jD+hrswMg+YXfjdwjjCQQMV2zDOSVRkk+bTm:MfBIQmZ8jShdjvjoCKVSDOiRkk+bi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638912995, "uuid": "58295310-acb1-4f60-92cc-72e877abd31d", "value": 2261976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638912995, "uuid": "81649f3b-65d3-48d2-a25a-41c28ccb69c9", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912995, "uuid": "35c2c21b-7515-4381-9364-2a75b042e7c0", "value": "Hadise_Ifsa.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf869f1-577e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638896049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638896049, "uuid": "f26e04b0-2917-4a1e-b59f-320a8a7d5a1c", "comment": "Malware payload (Heodo)", "value": "626f7c7abf0c884ff52b3c00562581c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638896049, "uuid": "bc874e59-d9c2-4f2c-88ec-4d23e287b9f4", "comment": "Malware payload (Heodo)", "value": "4b0b9d8ab6c2c20d71ee0c4cd8e5a674a1ebbed533d28133c19614ce7c831184", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638896049, "uuid": "f0cb370a-50a9-4167-8871-43fdb7cbbe8f", "comment": "Malware payload (Heodo)", "value": "353ea69d65d0569c673df58ef09b07d107c81d4d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638896049, "uuid": "449b3c05-2052-427c-8d28-11d20a491b05", "comment": "Malware payload (Heodo)", "value": "3998e4cc512f807cba2cec5fb694304f53e8f3a2a813f3e48b733e55586b2ee89ebbd9862fb7fa9070baa19f4baf952b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638896049, "uuid": "b34ac53c-3abe-4657-97ce-290809c34033", "value": "T12324D0B171808439FEBF66385D34D1845BAEBD90CB21ACEF7604019B9A685C08F73D7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638896049, "uuid": "fa080d69-5404-4361-8c5d-77ae60acb162", "value": "35dc3f1eb8a03291fc0dc93396a967d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638896049, "uuid": "798502e0-f2fa-4e82-839b-eac3a453be46", "value": "3072:MCDoXOpFVtI8/7gsEKr8x7tiUabb1mVDtnQhdYJBoo31kCsIN7Giz+w/gnViasLI:MGoX+VtZ/7vEKrWpwobHWo39sjC/Wss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638896049, "uuid": "b8071c85-ca34-46d4-afbc-79fadecf8023", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638896049, "uuid": "c4b1178a-2dda-4f66-ae68-cc5368d16740", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638896049, "uuid": "bfa5d0c2-0dd2-4714-8343-5c80ed676d6a", "value": "626f7c7abf0c884ff52b3c00562581c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f15e3b-573c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638867858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867858, "uuid": "7e597c38-8f87-4531-955c-d3f930029709", "comment": "Malware payload (Formbook)", "value": "629ea5c839acae348fea25bd5a8234bd", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867858, "uuid": "a8c3bca0-c47d-422c-9366-8338c95e38ea", "comment": "Malware payload (Formbook)", "value": "4b22c71e9620f6c305f8fdcdefbab17abb1ecb4dd04a6cfc534f99004d54d91e", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867858, "uuid": "b15114aa-2618-42bf-9bed-53d5a37eb1e2", "comment": "Malware payload (Formbook)", "value": "036b95ab324620637d715114cb721f9b47f4073e", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867858, "uuid": "311e90ed-d615-4c02-b7aa-a95f666f81d0", "comment": "Malware payload (Formbook)", "value": "cc352d4cceaa8fe9958482b04645c90d7516cbfe7cee557beb32c72c372a9c2683e32ee1c1831ed7baf341c34b2d1f82", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867858, "uuid": "eb956aaf-c66c-47b4-a607-195364557d88", "value": "T140742367328035117C3F37C9E9E63F5E40FC86BDB6169E73C04B2AE1012619BE95297A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867858, "uuid": "b85a20fa-1ea6-4552-b7b2-4f801beb86b8", "value": "6144:M89DmATawTFcx05+8F6TCuDFb9DkkIzTPQdoQrkrtgjqh9rjTI:mAugf5pYTCSFikGPOrqG2r4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638867858, "uuid": "9b23cb81-7c39-4f05-af40-a6f04d675ecf", "value": 347453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638867858, "uuid": "7a04fd89-b76f-4300-a099-9054c4736a09", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867858, "uuid": "bcd79418-64f4-4d94-bba3-08860ccf6e75", "value": "PI EGM05160 LC90 R12-6.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab2a2cb-5778-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638893497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638893497, "uuid": "7aae7863-249e-423b-b83a-6d0237b4fde1", "comment": "Malware payload (Loki)", "value": "e05b8500f4af49e55ab2f6c52d807ad7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638893497, "uuid": "3156a396-c1b3-4c16-8169-6811072c93a3", "comment": "Malware payload (Loki)", "value": "4c2041e94f665d78b253cf9f56eaf702e08954f9cafd847867471ebf012af94c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638893497, "uuid": "ce6f41a2-34b2-4d82-b758-e3e68311004d", "comment": "Malware payload (Loki)", "value": "120cc8908f31712413b43adbb388a9127e4b3222", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638893497, "uuid": "20318658-16f2-4fda-8d04-05af564fee58", "comment": "Malware payload (Loki)", "value": "082f13e8d353461941e7c7bf015255942bed30789c796fa7e245aac265f7868d4b58f039371318644b5f410edf5dd4a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638893497, "uuid": "6fa936b7-6ef6-40ce-978c-d27d2c611b7e", "value": "T1941512AD39A390CED292427C776FC07803B53C3A586BD2ADE899364F1D277857A53603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638893497, "uuid": "7738f53e-2206-40d2-9045-01ce00cfb5ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638893497, "uuid": "bcb02abd-ead9-4f87-9c82-01df6f68cc8d", "value": "12288:Gzd3Pt9BDvz8dJ0Fml3qG+yazVE43N2EEpqv1uyiG2xr6nVEmS/K/gYbwn7ldvz:gFDvIDa63SzVdwEoydomnVElYbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638893497, "uuid": "21db9278-8745-4217-a1ed-c10acb842700", "value": 942080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638893497, "uuid": "875b6441-bbf3-4f54-b2a0-7ad03dfbbf64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638893497, "uuid": "d3a26f6f-0c2a-4509-86dc-3dabf880e1b2", "value": "MT103-071221-B22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7abe1c44-57a3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638912019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912019, "uuid": "d78119b7-2415-4639-afda-a009924b85c9", "comment": "Malware payload", "value": "1832bed89e92edaf3c90f6c9d32a50fd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912019, "uuid": "d1d7d1d0-7579-4aa6-bf48-66896da793a2", "comment": "Malware payload", "value": "4cb3f5967878ee879b1ae40f41528b5a1df210827ac3d9590653e3fc5ad46eef", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912019, "uuid": "49483eb1-5eee-4325-8cf8-7ec438b4eb5e", "comment": "Malware payload", "value": "5fb6ac6bfe22ad3ac2883ac6f199861511294fa8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912019, "uuid": "7d5fa404-f0ae-4c9f-a356-88e6cfd1c9a1", "comment": "Malware payload", "value": "7cf10194d57d49b0c9d74f11063d798db1208fd3361716099a26ca85bd9303ce85d3ce0d2b5b67337518bccff6f58ff3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912019, "uuid": "a0aaad4b-3a10-4a0f-82bc-1c1a5378f62e", "value": "T19DE3133B9D4B7DAD2644B2DA4B52AE01B03F3F7625E1309309DC48A446D6A67F887FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912019, "uuid": "aff6f046-94d3-4f1d-a9ea-e8d504bcf8d3", "value": "3072:DE7yYYUgW+pIeNLJjJtDMOe1j0wHHJvhksRl5HtlJC9BeE/j+PW/HK:w7ym+6efJtDva0wnJQGESPW/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638912019, "uuid": "5b9ba365-2a77-4166-9f3e-35bf6932a20c", "value": 156886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638912019, "uuid": "feab74fd-943c-44b1-88d9-feb9b7a8b34b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912019, "uuid": "f891c230-9197-4a07-91bb-29a3429c70a2", "value": "1d32.doc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "525758d3-577c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638895201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638895201, "uuid": "3e9dc581-472c-4313-a76f-c79ac6db38d5", "comment": "Malware payload (Heodo)", "value": "596b1726814f4bce4330aee332810942", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638895201, "uuid": "2f1eda8e-d516-4615-9054-7f557344ae79", "comment": "Malware payload (Heodo)", "value": "4d01f10f6415f95c893182df2b3e4151a07e08e8fb672d55226946ab89514923", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638895201, "uuid": "0991bb33-b887-4198-aed1-05ceea67cdfa", "comment": "Malware payload (Heodo)", "value": "fedf91f721b72b9ece0e40ca4d5028f6cd03cc13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638895201, "uuid": "221e3417-b7ca-43a8-9f88-191a56945a58", "comment": "Malware payload (Heodo)", "value": "dec81ada10b03a7feeb431819e12a6356befbc93492877acd96859d7d0c8d1d8a788812ddc6c7d1171b5d475ed62fb3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638895201, "uuid": "f2833c5f-9b91-40f7-9e42-8d2ad5036b52", "value": "T1C924D0B171808439FEBF66385D34D1845BAEBD90CB21ACEF7614019B9A685C08F73D7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638895201, "uuid": "5f22c01a-bb5a-4fb5-b028-88a66539dd3f", "value": "35dc3f1eb8a03291fc0dc93396a967d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638895201, "uuid": "efc67264-ea1f-4c4c-84d1-6bb463fbbbc9", "value": "3072:MCDoXOpFVtI8/7gsEKr8x7tiUabb1mVDtTQhdYJBoo31kCsIN7Giz+w/gnViasLI:MGoX+VtZ/7vEKrWpwobLWo39sjC/Wss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638895201, "uuid": "9be7483f-c6ad-4d5f-aacb-26c5efd9b47e", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638895201, "uuid": "3526638f-1e3e-4596-8d46-2ca20ebe994c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638895201, "uuid": "252c88de-f0d9-4587-bf1f-2f065519b503", "value": "596b1726814f4bce4330aee332810942", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baad004c-5756-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1638879055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879055, "uuid": "a1168a82-ef46-4ff6-b1aa-40b7b7bd8aa7", "comment": "Malware payload (Quakbot)", "value": "3dffb160fbea5fafb7057e0761ca00c7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879055, "uuid": "fb08677b-e09e-4d08-9aa8-1d6098c0442f", "comment": "Malware payload (Quakbot)", "value": "4d3514843f4c4c944b14c27af6518e6223e963f5cbc525730de1a3b38d4f4e61", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879055, "uuid": "9f24d0fb-ec9b-44e4-8aca-078e83f43f2c", "comment": "Malware payload (Quakbot)", "value": "7c168116f03c325f48b804c7c520378588720a45", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879055, "uuid": "4d5ddc58-21fb-496f-a89e-046665359306", "comment": "Malware payload (Quakbot)", "value": "075a7b7ce29d2134c384c8c36ac61aa01c9f7db218fd5683bcd202a5a21d4173d66bc0c57af7fece1bb1b537839ea529", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879055, "uuid": "095879fa-998e-4cfd-b7ff-9ba9aa9f1760", "value": "T12124020DA83CE8CEC72F5432C708BFEB861B5061A9C2B82D55C9784D1955EEB7B8D18D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879055, "uuid": "a77fcda6-d81d-4e0b-a780-09b330a71acf", "value": "6144:1OKcfEw6R9537k5WSOeME6rGj/m/58DDy:1OtErR953gjrnOxR8DG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638879055, "uuid": "a34316ec-48a7-4a0c-833f-a4b67c847416", "value": 214723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638879055, "uuid": "c6608e0a-012c-4a2e-981c-a196cd650b68", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879055, "uuid": "ac5e562f-e34a-4928-9a60-cba1fc2ea64f", "value": "val-980205208.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d204a92d-5798-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1638907441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907441, "uuid": "9e91b3e9-9bbe-4394-86bb-67800ce79160", "comment": "Malware payload (RaccoonStealer)", "value": "11d684cd5cd5e103aa937dd1688d6ed5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907441, "uuid": "632fc318-538a-4940-8b03-c9f83c4c0746", "comment": "Malware payload (RaccoonStealer)", "value": "4d6db76398fa37523b40e69ac3ae9dea6d04c3c51cce4c0a72e5d312d14e5017", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907441, "uuid": "f8802486-6ac4-486c-959d-3b1dc84b30d6", "comment": "Malware payload (RaccoonStealer)", "value": "11460e16e261a645f860a8b7d0947b66a1a092b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907441, "uuid": "e7752017-bf98-4891-a929-97cdefbd090a", "comment": "Malware payload (RaccoonStealer)", "value": "24193cb1d11aba33c4571e9c33404c68a3851024f9e8fdce42ec8a2b5655a18da8a50b07c70399fa839cf05ea86807fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907441, "uuid": "a11fe26d-3a61-4f54-9f5d-67679dbf304b", "value": "T1B2C4E00066A0C034F5B316F88AB993A9792F7AE16B3894CF53D516EE17746E1EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907441, "uuid": "33b1742e-c95e-41e9-a1f1-074c239eb8fa", "value": "b5d39f822cf46cb1cac0e9a27db40014", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907441, "uuid": "7ab3fb9f-e55a-42aa-8e4a-ea740e0a6833", "value": "12288:yGoXmVL4VfFfRw1/+76LRBG0Sfk9CCk9uNNPkKiCA9:yDSUVn6vGCEtEIKi39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638907441, "uuid": "f501162f-633f-495a-9df6-4f84613962da", "value": 585216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638907441, "uuid": "1b81b5b9-63ce-45c0-a108-c5058732bb7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907441, "uuid": "3ca849b8-0cfe-4296-a006-bd17e62a7a3d", "value": "11d684cd5cd5e103aa937dd1688d6ed5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cab1401-5737-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638865663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638865663, "uuid": "1432db78-37e0-4b9f-a0e8-a9639de8482a", "comment": "Malware payload (AgentTesla)", "value": "3c4c1cf0aa3229d555a26202c4c33b6b", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638865663, "uuid": "a72bbaaa-c77b-4b1b-a7b9-96afa931ca1e", "comment": "Malware payload (AgentTesla)", "value": "4d848d1ff2cbd2d1c8215c807bc488b85eb257e7e84419f053d9969db7567bff", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638865663, "uuid": "eeaca49b-aabe-4c50-a20c-d86c54ff219c", "comment": "Malware payload (AgentTesla)", "value": "3a944ccd5edd3228e5d1c75e310892de28c76952", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638865663, "uuid": "e411378e-bd2c-47da-987d-32d7b228af38", "comment": "Malware payload (AgentTesla)", "value": "e776f10b8db8e2be7b0058d7272d5929b57d9f1354dfbbd1e743953e8b620e2bade271a631919fb2c0e1a294332e0b94", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638865663, "uuid": "8f582f9e-92e0-48ab-9c54-4eb52d1fd2aa", "value": "T18A34237C19A6DB8F122E67060EEF489C581A51FC1F630C4DFBCE2A90118096DAF6A573", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638865663, "uuid": "ac48b72a-d057-47d7-a22b-02ca63e3104e", "value": "6144:Wty1stmmq6+jmd9/c+3qapLtOfHRAxQd5E:Am16V/cQj0fexk5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638865663, "uuid": "b3ed1769-769e-4522-bf6e-339ebc69bb81", "value": 245614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638865663, "uuid": "eeca4865-0878-4b02-a238-4dc243f4ca6a", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638865663, "uuid": "2e61da5b-21e0-4f75-a267-b4122b297c86", "value": "Shipping Documents.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d915255a-573b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638867509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867509, "uuid": "cd724acc-da3c-4726-a9c5-7e2ca51f5fac", "comment": "Malware payload (Heodo)", "value": "5238d5989867c1982c638ac37fd0d2b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867509, "uuid": "bcb40606-fd60-4c02-ac57-34fac63598b8", "comment": "Malware payload (Heodo)", "value": "4d971834aecdd53b1335a7419ba35ec948eda9a4f079106b5883c59bb66bc17a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867509, "uuid": "419f0136-2fff-465e-b9d4-d0fc712f8d9a", "comment": "Malware payload (Heodo)", "value": "4c46792fd44718998b5cb14ad3c238476f89abce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867509, "uuid": "0261e2e7-d81c-472a-aac8-2e8eb75fe34e", "comment": "Malware payload (Heodo)", "value": "054e8f0d4859e4e0699357a3bb7fcaf79849f72c78e60c8f0cb4c014cbebed041cefdda2a16def560187c193faf5f221", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867509, "uuid": "a033e7fc-efc8-4c77-ab0e-70dd336e1d3a", "value": "T191F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867509, "uuid": "587de8eb-72e2-44fd-8358-6bbfbab98448", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867509, "uuid": "d70a8ebb-2b0f-40cf-9cd8-683f32e94e17", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/c:JapiKiBEmj4GbOX399Md9J/0TK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638867509, "uuid": "e5920977-390d-4765-ab0b-3d6839866402", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638867509, "uuid": "8b809984-d479-4c96-a539-400f620acd40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867509, "uuid": "74cffa68-4d46-489e-84c8-3d4f833fabc7", "value": "5238d5989867c1982c638ac37fd0d2b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4c6d1a2-5751-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638876924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876924, "uuid": "5409d145-2168-400b-9ca7-afffedbe7d19", "comment": "Malware payload (Formbook)", "value": "71c8a2cb434b1dbe558c404795c4d18f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876924, "uuid": "f1f152ab-3a7f-4565-b807-70247987c7d1", "comment": "Malware payload (Formbook)", "value": "4e2b20cf2415b3f6c6dc1edfeb7448ec4d1ff9ac32ef041913fcea71902f7f3d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876924, "uuid": "01888191-5109-4755-9f49-617913b75907", "comment": "Malware payload (Formbook)", "value": "c5e61fa4e3a88afe0d2fd9634eb682ea7c701506", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876924, "uuid": "d15b75f7-2a02-4d4e-ae01-11f34c3c8a52", "comment": "Malware payload (Formbook)", "value": "b685ccc4e9041af4e2656a6da187420782213c0e3cd22323e28915dd8a65321c60dbbe8dd48c84510d54ca1c2f954281", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876924, "uuid": "71edf03a-2bb7-4a6a-895a-acfa390955da", "value": "T1DD3412863574815CC9F427B89A6FC2E4AD32CEF207C2E8D92692738B7834AE50D5359C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876924, "uuid": "b343d0ef-e4f3-457e-bc1b-1625de5ae648", "value": "6144:Ot/HSNdfkGI/RQ2GdwwA2bDipYobZOcER8T4CnL:4/sfkG4d+bwYoQRYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638876924, "uuid": "64904ee1-6ff4-42e4-950b-ea2bc60792ac", "value": 234488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638876924, "uuid": "f8978b22-2697-4280-b575-26685ff29dc7", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876924, "uuid": "f59862e6-f14b-4af1-bb09-445f0e5359fd", "value": "SHIPPPING-DOC..xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aaa92c9-573b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638867378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867378, "uuid": "e05afad7-8e52-40f7-998a-969144efb8e9", "comment": "Malware payload (Formbook)", "value": "4bd9471a376c0f74e2f8f4398a73cf78", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867378, "uuid": "2688d69a-aa32-40bb-b046-cb8448b65b58", "comment": "Malware payload (Formbook)", "value": "5032e8c28a5ffcd97bc8451bb5b5ca524fe84eb7f7fcc3ea1fadd211c6e00e95", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867378, "uuid": "4725304c-ddc3-47d3-96f1-3bf8b340e406", "comment": "Malware payload (Formbook)", "value": "fed585991dc7f7321b2b123e5fe5ce6440df69f0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867378, "uuid": "dbcb73e4-1444-44db-bc13-6c4764ba80a7", "comment": "Malware payload (Formbook)", "value": "df85c35546da7e23dcd93aafeed79123c4775b7bb1831d13ee4a87629013ed8e1a56a640719ca755f5c5453c016b5f67", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867378, "uuid": "26d60439-581a-4f07-a70e-5c564125756e", "value": "T14C55582C26B5085BE97D1A341425073B8EF26C3D997BE3CD3748356B4BB36840A257EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867378, "uuid": "2f38ee52-8f95-4421-a25e-46ac3a1853df", "value": "24576:b7GtI9RLz3j/9Wq4mHhxK+EI+ValYffwOlGdKWXVz8C3Lj:bCeLlWq4gxPaNwOlNoVz13Lj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638867378, "uuid": "fa5689d2-b574-41ec-b6b8-004e890b3307", "value": 1339392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638867378, "uuid": "e245fea5-1802-418d-a6b7-6034392644f6", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867378, "uuid": "40ebd3c4-a39f-4baa-ba49-8e5e6e9ed069", "value": "wanted list.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e7162f-57a3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638912227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912227, "uuid": "3ea19e4e-693c-497e-a635-dedb598f6627", "comment": "Malware payload", "value": "802fa3aab544b1acf359ffce404ddc85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912227, "uuid": "a044337f-6390-4356-8869-4b3af525b61f", "comment": "Malware payload", "value": "51b1472cdc8034acd1518ac9ef068ea546f318088957a52f14e6112dd0f33f73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912227, "uuid": "66d7cfc5-bbea-4a22-8605-aea4b679bfd8", "comment": "Malware payload", "value": "f94124baab413801a966adc06f3a5005afbe0d01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912227, "uuid": "5185b0ef-e92a-4418-bf5d-d424dc5c880a", "comment": "Malware payload", "value": "0728358d683a66d6d818a94971f7a0c318402ed42a8ca5f679ff47dfd7a15f5028d15ef6c8893900f7bec7d7e71c5b0a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912227, "uuid": "bf62b10c-610e-4ca9-90a4-7cf837347d26", "value": "T11AD4F1B36323A0C6D8E84EF049478C725AD3786CAAC1071E65CCAC5BCD6339168E97DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912227, "uuid": "27833d99-a702-4a65-9799-ce99bb932118", "value": "883398a129119524ff72dd8a39f08f4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912227, "uuid": "e841ce7d-eb63-4a9d-8e9d-44953ae46277", "value": "12288:haeExHkXCj/Z0xiGf7hRw4zPSSktjFhQod+1b:hRMQmSHf7TwqPSSueodC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638912227, "uuid": "2914a481-7617-4410-aa71-f5f262e64761", "value": 603728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638912227, "uuid": "0efea912-d7ef-4cc6-a198-3f1807c95b4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912227, "uuid": "a650a481-5dae-4195-a686-e4e8dc1122a8", "value": "802fa3aab544b1acf359ffce404ddc85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c24798-5753-11ec-96a4-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1638877677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877677, "uuid": "1dd473ab-7f4b-42ff-996c-eb9708e5ffb3", "comment": "Malware payload (TrickBot)", "value": "1b4787fe6982c2147f03b03a48a8da72", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877677, "uuid": "f052264f-6104-491f-b248-6f3154add897", "comment": "Malware payload (TrickBot)", "value": "522f0758b2eac46d2282fbd3ce0befb1041e6cff81a43f07e343166db4ab0934", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877677, "uuid": "e10df372-dafd-468f-ac52-c9184c59aa4c", "comment": "Malware payload (TrickBot)", "value": "51f8337cf0f4352d3b78bbfbd262ddf5107afc4a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877677, "uuid": "61c43788-07f6-45e2-9bb1-09bb2bf0ad8e", "comment": "Malware payload (TrickBot)", "value": "02381444245a667ab53059faf05dbe82c8c4f14cbff262c5eaf3b11cae4f3b0d84c61319395fa0166f357266b1a82aa9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877677, "uuid": "85c18907-fff9-465c-b7fd-dfb8cbc13969", "value": "T174C4E2F5A073D554FC1F26B2A9C128884AC33DEB3A0EDF4A0118B57F29755D83A9885F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877677, "uuid": "7d0f39b4-0add-4bdb-9f08-cc2e01b79732", "value": "3072:KtwrI4IezG/34j6zuMWdQYmmp8B7tQnrjgtHGZ+Y+:KtwcEG/qgudmw8B7rGX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638877677, "uuid": "8711a204-a9a4-4f4c-a8b7-f3d89f0aeab9", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638877677, "uuid": "00eedee4-2502-45db-aca9-c63e3c3706c5", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877677, "uuid": "5fd26aa0-16f0-487d-b8c0-5027eb5f83ab", "value": "db2d.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "257d91a6-57b8-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638920895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638920895, "uuid": "4636c827-dca7-41d7-bc73-bf65ce0a4754", "comment": "Malware payload", "value": "e776e5addcb102533a5353060f730c4d", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638920895, "uuid": "e19df337-041f-412d-a7bd-c77f74381d22", "comment": "Malware payload", "value": "5255ac46ee1510c9b72342e69788c04c0aadb5fca1a318d6b13d6cabaee54c04", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638920895, "uuid": "4c2f47d6-7a62-4b4e-8e98-a09bbed622f2", "comment": "Malware payload", "value": "8f46da4b3fe61b52287c9367df5c7f619b8066ad", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638920895, "uuid": "0cba12b7-1fb2-4979-a93f-66a3758f1b7f", "comment": "Malware payload", "value": "bcce75030709b42d9f414b48a5fb6815e8ec878b41d6e21dfa138dcd421d14cf8663c8c5523c943b048a3881b10c267d", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638920895, "uuid": "90e2d33f-74f9-46ea-84b7-51c6dc487969", "value": "T1DED46C55BECA6EA1EFBF47BB8361D62D0226735D03A1A6CF760305993951FC2443EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638920895, "uuid": "36640f8f-aa3c-429e-8748-84216b6b9f65", "value": "be710ba34b048ab0098050ccf62e369c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638920895, "uuid": "8a606171-fea9-4a78-839c-7117d6b5e4ad", "value": "12288:90Ws7IMtR4yVld8bzbBSre5JOgFK/UqWF:90bdkX1X4cL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638920895, "uuid": "77765bb4-ecb9-4694-a983-7bd4a6ef36dc", "value": 654848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638920895, "uuid": "17aad92a-65e9-4319-b3a0-074e1315391d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638920895, "uuid": "d2566b2e-b01b-4151-90b4-42c48cb4534b", "value": "dn2.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1510f1eb-574b-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638874052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874052, "uuid": "92e2f5b4-6f80-4a71-b25a-daaf96edc964", "comment": "Malware payload", "value": "9ea6ebe1cb54ad4b2fca36fd3307ebaa", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874052, "uuid": "5bbfa3ef-9a75-429e-8b5c-74975bb9fc5d", "comment": "Malware payload", "value": "52b32d417e469fddb09b2a14747de6b8dcef327c8f5f76bcec79bc678be87c54", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874052, "uuid": "ce33e514-ab61-427e-9448-0297467ea5ec", "comment": "Malware payload", "value": "902ace88f7d180bf00d985bc70a2998756bfff38", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874052, "uuid": "ee209f82-143e-418d-a2e3-77a5921f2271", "comment": "Malware payload", "value": "d6e85d0d08fde24148cdb2805a9e0d4d87aaa0615b98b2aecb128569acfe61f66db7b185169caf4b355a93b7c5867b27", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874052, "uuid": "9e19041a-b47e-4908-9452-76a582bb7bcd", "value": "T165F48C12B3D9C536E07B42706D3B8B9A9535BC604BB1C1EF13D85A1E1E73AC05272FA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874052, "uuid": "c2a45ba8-95a3-42cc-b80f-311f935eae0c", "value": "12288:bWdafY8owv43bqKlRH1Vq9iyXKAOusc52iR2iR2im:bWdyY8owvitjVqoAKAdt2iR2iR2im", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638874052, "uuid": "3df8382d-06b0-45b1-990e-de73a011f413", "value": 745176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638874052, "uuid": "40804996-a4c0-4186-864e-db909de6ea88", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874052, "uuid": "9bd7cb58-1073-4624-8f09-47a951b4f21b", "value": "NFE_459876.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bcb2bea-5735-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638864668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864668, "uuid": "dd400e22-4c02-4671-a079-6c191af111dc", "comment": "Malware payload (Heodo)", "value": "8df34df621de04f162e7948fa690507b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864668, "uuid": "9813e232-11fa-4f81-89c5-b4b83ecb3dba", "comment": "Malware payload (Heodo)", "value": "5311996db3f1214b48fb796cc102b05b6fa4f89266d095e4adfa591b4bdebe89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864668, "uuid": "4805856e-91e2-4bf2-b1bc-c36829aaf7dd", "comment": "Malware payload (Heodo)", "value": "155bcafb78866423582cc7b590030e43923e9d82", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864668, "uuid": "eb27e29b-2de1-4623-b82d-08d6a4bfe10b", "comment": "Malware payload (Heodo)", "value": "39265d9c59b99690fdc5ef5da9df6cfa371a2d281f740f7b303a9ba48377e1508201b9c7536b728b66a341c4f4ba0ec8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864668, "uuid": "62cbf339-1cf3-4769-8192-80a3c3aa3437", "value": "T116F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864668, "uuid": "3932cf6f-c122-40ad-bb4d-033292b98494", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864668, "uuid": "662ff2ec-098b-4528-858c-f5b434cfb9dc", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/m:JapiKiBEmj4GbOX399Md9J/0T4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638864668, "uuid": "e1151b5c-b8d2-4bc7-b6ec-483d3608cd64", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638864668, "uuid": "90bc75bb-1b30-42fe-9fa8-e5e9fd471358", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864668, "uuid": "11633425-2dc9-43e8-b4f5-9799c2d96892", "value": "8df34df621de04f162e7948fa690507b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d92e829-578a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1638901206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901206, "uuid": "b2bc767d-547c-4a6a-9c70-a475b2a3b4b6", "comment": "Malware payload (Gafgyt)", "value": "4715b7eaf954f89821bb3fe5c6ea595c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901206, "uuid": "32b23e75-0fcb-42dd-afca-9764d11a8486", "comment": "Malware payload (Gafgyt)", "value": "53c624a787a94aa3cc4b7df7f578f1d2f5310ba801b10be05c192605861ae717", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901206, "uuid": "1288c797-db17-44e8-a858-40b4d14bb33c", "comment": "Malware payload (Gafgyt)", "value": "d1ff887319d9e1ffe8c3c67826bb64bea08d4131", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901206, "uuid": "b1ce0832-07fa-44c0-9904-2682f5bcef9c", "comment": "Malware payload (Gafgyt)", "value": "54382abe583142f0dd00a956951aad84b0f6bcbb01d3bd1eb5b04d2f20e5952aa69ee805b8a25c6881796a92b43ae41d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901206, "uuid": "551d546e-f8f2-477e-862a-0ff09c11b937", "value": "T166834BD5B8014D7CFD5BDABD81224B09F92163108FA30F2BA6A7FCA76C331999E06945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901206, "uuid": "0890a6a5-0e34-4f03-9c75-a01421ed16a2", "value": "1536:w0/QIN0qBSn1c57gjYcMWlmPkORkVK6tLUEqVMH6hzFOZFfXtGn8Ve/z:w4En1c5Mj1Mym/RYh1qeakXMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638901206, "uuid": "ffeff8c1-5ee7-4639-9087-e5cd09baec80", "value": 83276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638901206, "uuid": "e57e4363-646a-4fcf-82f4-5145cf82612f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901206, "uuid": "a8c9b7fa-66b8-4035-8cd7-e17c396be1cc", "value": "4715b7eaf954f89821bb3fe5c6ea595c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f85384-5751-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638876931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876931, "uuid": "ab72a3d0-5306-4ef2-b146-ac4599addfcd", "comment": "Malware payload", "value": "658379743545373fc30228e86ce692e0", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876931, "uuid": "dbcdda7d-0e95-4ceb-b73b-7270ee116b5b", "comment": "Malware payload", "value": "53e8bea396ffe7c90d7a3245b45a7afe208e3a876154bbca60d26153d2eae793", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876931, "uuid": "febb2f2e-c193-4220-b76c-8043306c06a9", "comment": "Malware payload", "value": "288f427951afecdd400bc8f46eea5392397e09b4", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876931, "uuid": "7ce8ef03-79d7-429c-bdf5-504ea76b1df9", "comment": "Malware payload", "value": "69f72253d5b44cabb93813ff2f8cc091c5947b98a2297ba140d6d0eeb2ac18a60a3b0a71db7049bb4c09c73c15ff463c", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876931, "uuid": "c9df218c-fcf7-4f70-86e9-9f0787b55cd6", "value": "T16834121E7FF60314EEB4C176D7C6DC926429EF9E821A83259824F27D6AB11470268FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876931, "uuid": "104ce8e3-f8f8-4294-97a5-d8ac1e1aabb6", "value": "6144:jALMoNFRel8txVa+x/lUn5gqEdvKDgT4d3L/GvocqstL:0YoNP++x/lUg9vjTdvocqstL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638876931, "uuid": "57429c04-edbf-4088-8ebb-c702f8e1531c", "value": 234168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638876931, "uuid": "32c6168b-a674-48ff-b9c7-8384fd9d100b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876931, "uuid": "dbc72d3b-f795-4b17-bb5a-6c6bc5a144a3", "value": "RFQ SPAIN INQUIRY.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c010df-574b-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1638874032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874032, "uuid": "b7270e8d-bae0-4129-bc99-94aa95c302c5", "comment": "Malware payload (SnakeKeylogger)", "value": "6430cb23ebe6fd38dd12dd0a579e9e3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874032, "uuid": "73992c0a-e8c2-46d4-b190-66e831d57d6e", "comment": "Malware payload (SnakeKeylogger)", "value": "5405e311e63cb69c69bc2eba909547fca4d91a60e998bcc825c1031cd148f816", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874032, "uuid": "1ef05713-9a35-4681-89dc-b9585e7b3a70", "comment": "Malware payload (SnakeKeylogger)", "value": "0564f13201c8d65ab64842742c761b5bc912b832", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874032, "uuid": "c603a528-82c6-4c87-a992-fcb4ad9afa0a", "comment": "Malware payload (SnakeKeylogger)", "value": "9385c2435ff86c337b218c08aaf28e7d5c664f9fad58306bbc86f7170b3f539edfac6f8d3913a0353fd287d3a2e7ceba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874032, "uuid": "13704b5d-d2c7-4e4f-8575-71df2e5007c7", "value": "T1FD84BE93B514A0FDE17D5633BE87880D62A22DF59D42C50936A7FF5A39313A00F84A7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874032, "uuid": "f9882467-be5d-404e-8960-77fde04a8a97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874032, "uuid": "9d50e3df-46d1-4630-ac67-43bb7f07f70e", "value": "6144:WSd9KKY2kQqvZRHAWLuvDReY7aHh9C47dXBaNFs63GR+V/uiMIkqS8RGCJ75j:iK8u74Y7ALvxXBOlvV/unISSNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638874032, "uuid": "341844b4-a895-488d-bd15-746e14eede8a", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638874032, "uuid": "4d240cf7-4dd3-49e6-84ec-d83d13447b7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874032, "uuid": "428deaea-32de-44ab-a74f-d84732038412", "value": "6430cb23ebe6fd38dd12dd0a579e9e3b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c85d71-57b9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638921540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921540, "uuid": "edcc7c17-a6d2-41a4-90e6-3898ad8a0050", "comment": "Malware payload (Mirai)", "value": "dffccb7fddc56e322daebcc7f00ed7ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921540, "uuid": "014cf56f-6f49-4558-83ef-51cc9483dbb9", "comment": "Malware payload (Mirai)", "value": "5501d97a2475460ff466132ef9413f98963b1f229f340ae26dabfacceab72a8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921540, "uuid": "46c33c74-739a-4bef-973e-e9cced5403b4", "comment": "Malware payload (Mirai)", "value": "580d56d7b2158b9173e82fdd8fc2aa90a432a9c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921540, "uuid": "034209d5-595f-4c69-badd-1ff384c2e43f", "comment": "Malware payload (Mirai)", "value": "e8604c71d4ff3e971a37a4f4faae955b57ffc0625eec39a5ef4e6480e914ae67d04b6834e88af10564d8898c14923766", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921540, "uuid": "a908a030-7c13-404f-8e66-168f59abed99", "value": "T17AE2E1FEF0915986CC7EE87D39FE1A36CB0060C12BAD4E699315CC8CC667995B94C4A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921540, "uuid": "4c6c955b-b50a-489a-92e5-1db4afa20a75", "value": "768:5rO0mfJqTGCueVvHAciS/7qA3XrwSEbW+:5usGd6gcZ/7qs1E/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638921540, "uuid": "49ef6300-c5b3-41be-b13d-a3432fdd3407", "value": 32120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638921540, "uuid": "36d50252-2c9f-4681-849b-ce2e54e39c99", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921540, "uuid": "41a7d958-1e59-4c17-9439-2aa5364c779c", "value": "dffccb7fddc56e322daebcc7f00ed7ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e66968c-5764-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1638884967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884967, "uuid": "95345e07-a816-4e18-991f-ce74a34cab3a", "comment": "Malware payload (SnakeKeylogger)", "value": "6aa535bff38632c97a8091bded3c08b8", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884967, "uuid": "00c8ef35-16c6-466a-af9e-e214bc68c68d", "comment": "Malware payload (SnakeKeylogger)", "value": "5509c7dc3847efece83c6bb9accea4f5a2cf17de4e81e0e66cb0c8b40b773843", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884967, "uuid": "020307b5-30cc-46c8-81ce-e677f0511c95", "comment": "Malware payload (SnakeKeylogger)", "value": "fef88463d9ea85b5bbfcedb6d78a82b4859de671", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884967, "uuid": "4a0014d5-da30-4354-961c-300dafe83067", "comment": "Malware payload (SnakeKeylogger)", "value": "8f7df6d7bc46b026b085b7d0799078fcc48364894050d43d81c98d647065fa21751cfb788ddb77db52474eb42b16df18", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884967, "uuid": "9a64dbe0-47b6-45f6-b9e1-44267647f920", "value": "T1D413F25F672E585E095670203BA570C3544D65CEE0A11EC0D10E5B3BB3A792777E2EF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884967, "uuid": "890d8c59-0a0b-47dc-87f9-c2905f01afc1", "value": "768:MGlBlk5+a6SjSTvd2qG8U9NXBDDsKnFBV7+3X7Hya6hvnqHsaB6r1tUCqtUDa7:Ms45+V82UvBPsKFX7+7Hya6hvqLB2q3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638884967, "uuid": "08c7682d-616e-486d-8fba-f4a62a5a274f", "value": 42574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638884967, "uuid": "4693cff6-006b-47a4-8ab2-a857458f59ad", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884967, "uuid": "f2891197-90e3-4eb4-b93a-6a08e70f48c3", "value": "Q-700004637 1004913.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c874e3-5722-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638856474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856474, "uuid": "9a1f3d94-d7c5-4e13-9f84-854558c5657b", "comment": "Malware payload", "value": "0b1f16f067ba71f5b8ec87c9f1a544c6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856474, "uuid": "dffe5509-9c2b-40c0-a5d6-bd0218abb9a8", "comment": "Malware payload", "value": "55de08cdcb3a281169111d7de8ba48fe65c94eb0b30e7d46c1bd6d090b1a284d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856474, "uuid": "94a6d351-82c8-45f1-bed3-c7494c61a796", "comment": "Malware payload", "value": "d37373035388d9741abbeeafb132c07ab49136e5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856474, "uuid": "e66af782-bed8-486b-ae94-a98f5d842b26", "comment": "Malware payload", "value": "1d287fe0bf3185bda4e4cb491b93d783fc1c2362166df0a1df22592f3bf1bdf0d93d91e2a0149553754e720f8c795eac", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856474, "uuid": "0db60602-169b-4e09-8471-36b315414e6d", "value": "T139866C197AAC4165D0B3C2BD86DBC987F6B278051F319BCB0665436E1F37EE1493E222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856474, "uuid": "4208aa9b-9ecb-48ac-a80d-51c4d86400d1", "value": "3fd95ad73eafd552fa062e48ae42ef88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856474, "uuid": "95b8d35e-b3a0-4ab5-b6a9-e201e11f421a", "value": "196608:GJzColboj5Vxw0XIgOQgEsgdpVT/e446ETE4ct:GJzColboj5Vxw0XIgOQgK3Wi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638856474, "uuid": "ae527437-9213-4b27-9fc9-f676c2114c94", "value": 8476504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638856474, "uuid": "4075fedc-77ac-4b15-bf2e-6c28ce8b57b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856474, "uuid": "f9f420be-6073-4280-b3f0-9e8cebb7c030", "value": "0b1f16f067ba71f5b8ec87c9f1a544c6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "657583e2-577a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638894374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638894374, "uuid": "5594f88e-d3d5-41d5-bc27-5ac466a2b584", "comment": "Malware payload (Heodo)", "value": "e941d06db28ef0bf125af8751214bf15", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638894374, "uuid": "226b1788-e1f6-41c4-b1fa-3ab708d46768", "comment": "Malware payload (Heodo)", "value": "562a33e07d345a4ea7a01d0ab18d417357c38e3fa68e39b3d7486c85fac3a553", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638894374, "uuid": "a99a2302-5397-4925-aded-0c8cbed73ae4", "comment": "Malware payload (Heodo)", "value": "45a0622a711386515cda9a7f075dd6cd4d6fade9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638894374, "uuid": "06a1e504-9dc4-446f-ac4e-f1fddc76d2bd", "comment": "Malware payload (Heodo)", "value": "0f17716c828c1c5886e1a266f101920ae69c4c6c9c05e80fb868ad8dc8b9b3d573dbd44f375d886765a96d314280b87a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638894374, "uuid": "ffe2d9eb-997c-49b1-8b49-557d34c8441d", "value": "T16055CF043D8180B6F92724391238B7658FEC69210B30C9DBEB94ED7D5E25DE25A3E1DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638894374, "uuid": "fc48f5c0-6a38-46b1-8442-2e87323154f2", "value": "ce5896fd181bed8a87ce7f299693cafa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638894374, "uuid": "78a4e71d-a771-451a-b502-56212d4e9e58", "value": "24576:a/eZY5g4b9/LwRMGS9sBS0EPG9RIOyp+PB9b12mehjfhfyxI+tORocluvCqknhWE:Nihwm98f9RvPXehKI+t6zRi17oN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638894374, "uuid": "84470f20-4ebf-48c6-a3f6-52338bba7601", "value": 1355776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638894374, "uuid": "a94d179f-a7f3-4c76-9540-eec5b4296c0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638894374, "uuid": "a027883f-018b-4f86-88af-569c770576bc", "value": "emotet_exe_e5_562a33e07d345a4ea7a01d0ab18d417357c38e3fa68e39b3d7486c85fac3a553_2021-12-07__162608.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80c4569d-5740-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638869509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869509, "uuid": "ada60dfb-c7e2-44b1-b8d1-e8c2c9d8aec2", "comment": "Malware payload", "value": "4bd1a992438847af8e48f54681b21252", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869509, "uuid": "9d0f3e93-19c6-4091-8ed6-4b754317dfab", "comment": "Malware payload", "value": "567d3e334c64ba61afbae2c20406302c785b909203ce7e53969ccbd0e7ff8a18", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869509, "uuid": "a4f59510-f50d-4ae8-8470-d771a2fa9091", "comment": "Malware payload", "value": "10bf29842cbf47e7fa7350470feb4dbac8a8de14", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869509, "uuid": "4c8fdbbb-8ed7-4ece-8134-dcfce1c22e76", "comment": "Malware payload", "value": "25ac1cef5f1068caf4895d79f5d290ba31bf9b4ab71682ddddf01904511678c949b2478c07ff930bbc42c6a44abcfcf1", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869509, "uuid": "88636a93-3533-4815-a89a-c179a39a5852", "value": "T11FA412AAD7C3CCDCD74B52B049485592100DE5DB49B2726A327F989E7B11F822F8D2F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869509, "uuid": "f7edaaa6-2d83-4b23-9c16-b9a17349329c", "value": "6144:hTorwpi1xO18K9JfKCswu/cD5V/WMYkOcegRV7sHIQatS4EW2rasvC1m:Ro9fKiCswukFVakO8SH1atS7B+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638869509, "uuid": "6c3e83b1-19e4-460a-8ea0-fad4795f22db", "value": 461233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638869509, "uuid": "f0f931fa-da17-4d10-8507-11e37aeb3d39", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869509, "uuid": "517ce7a8-1bdb-41ef-b05d-d635d4ef6666", "value": "Global Comp Sheet 12-06-2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "493d1b6e-578b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638901628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901628, "uuid": "ed07479c-daa8-4b89-93ae-5e505fff6de3", "comment": "Malware payload (Mirai)", "value": "8b0ae575bc4df2dc71370ed7745a3e3f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901628, "uuid": "8e413a5f-a651-43ec-98fa-818ec2df1ad2", "comment": "Malware payload (Mirai)", "value": "572d3406c09cdec7e169d36b1fac254fc9ec0742fd08ef51abe90a9f7ebcacf2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901628, "uuid": "5ddcbeae-1ac0-4da0-94ea-83ba380e6bd8", "comment": "Malware payload (Mirai)", "value": "185de03d433d02707629d8d8b5e8d65ec3ea2a7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901628, "uuid": "91a52c01-dd98-4889-a92c-8bba17b5b3c2", "comment": "Malware payload (Mirai)", "value": "3266e4d928892698c533f886f2b763b7ac9498f558ff30c43e27b3fa45cda32e8ce54cba1d5fcc14de644e57a852fce5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901628, "uuid": "501458f8-f1fe-491b-8957-f3a595c07b50", "value": "T1EE433CD5F801AD7DF957EAFE44624A0DBA21721150A30B2BA36BFDC37C332A44E16D91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901628, "uuid": "24137e17-5dbe-4f6e-a316-d98306275a18", "value": "1536:bFyTOn7IOlZFl2x+qEbYbKup7X6Y3fG8ce:bFw22xJEM/gYPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638901628, "uuid": "8fa03fa8-0d8b-41ac-b332-950aef1b8c90", "value": 57244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638901628, "uuid": "a1377ce4-310d-402a-a0a2-605b44eb7aed", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901628, "uuid": "a73fd58f-a02a-44f6-98af-cb07f85c3a0b", "value": "8b0ae575bc4df2dc71370ed7745a3e3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1736302d-5767-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638886082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638886082, "uuid": "6ef1184e-9568-4691-a58e-f0751b48a018", "comment": "Malware payload (Heodo)", "value": "d29ab23247755785dcf93999a7d44d5c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638886082, "uuid": "7a6ec4f2-97a9-4380-b5ee-5eb1f6dbab2b", "comment": "Malware payload (Heodo)", "value": "574d9a97092f83e4cfa9b801ef66d29fc42256a67240c67e55f83f09ec8dfe50", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638886082, "uuid": "12ca687b-d142-42d6-8619-96b1035887b0", "comment": "Malware payload (Heodo)", "value": "d64b231fdd58adb98fdecde4c65eae31ae4ada07", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638886082, "uuid": "44143255-a01d-41e7-9d4b-1fcfdbb01669", "comment": "Malware payload (Heodo)", "value": "71763b37dbc8ce2f47572c1cd122bd2ad15b035dc96add00495818419c65019f2ffa3dc4036508dd95acc4f23eed268e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638886082, "uuid": "cad0166f-d111-4c56-a522-503a455dc6f8", "value": "T168F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638886082, "uuid": "4f935fe4-ac60-4689-88f5-db1a841426fb", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638886082, "uuid": "9af56c2f-eea8-456f-a6ad-ebf3c9a586d3", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/+:JapiKiBEmj4GbOX399Md9J/0T4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638886082, "uuid": "c2467381-faa3-46c1-8d91-adef0d74043e", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638886082, "uuid": "c37c75bd-1a7d-4a76-aa41-b01455f29b04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638886082, "uuid": "b8d67eae-b00b-4c91-ae94-30e5f3a8c102", "value": "X0UBBDDum.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eec88ca-577c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638895195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638895195, "uuid": "fc4229b0-fecc-4bde-b39a-fa369715e3d7", "comment": "Malware payload (Heodo)", "value": "0ff381dfbc8e69884a9f1ad2607101d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638895195, "uuid": "cb6e6c75-7db6-4d72-92d4-cb1213777d4c", "comment": "Malware payload (Heodo)", "value": "5752276ffde7373fc70061cb81cbc563a090b88d7b23b2bf9512fad0ca561815", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638895195, "uuid": "34e4e648-1956-4921-a04e-08ee602fbab4", "comment": "Malware payload (Heodo)", "value": "34d83b4c5b940f37108f7c7d07c2196cea0a75a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638895195, "uuid": "e44a7f06-a4f4-4d6c-85ae-39f04d385031", "comment": "Malware payload (Heodo)", "value": "c70ac3826cc624e6ed3f327173f8ffc41494f3635b3ef7cb50c76ff891637c299fdd5651e2ee6c6a6ec0e0455b0975ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638895195, "uuid": "d9132ae7-de41-43d1-8f61-2b13ef7c9528", "value": "T10224D0B171808439FEBF66385D34D1845BAEBD90CB21ACEF7604019B9A685C08F73D7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638895195, "uuid": "2febe51f-0ea1-4fec-b930-6102d76137b0", "value": "35dc3f1eb8a03291fc0dc93396a967d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638895195, "uuid": "3a3d54d8-4965-4cd7-b25c-373162b16b8b", "value": "3072:MCDoXOpFVtI8/7gsEKr8x7tiUabb1mVDtIQhdYJBoo31kCsIN7Giz+w/gnViasLI:MGoX+VtZ/7vEKrWpwobSWo39sjC/Wss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638895195, "uuid": "9af9292e-1a8c-4032-a2e0-a14847467c32", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638895195, "uuid": "04887fc8-300c-49cd-9753-f7e74a5f5d21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638895195, "uuid": "c9d8978e-e807-4ad0-9ca5-07933ed5c1a1", "value": "0ff381dfbc8e69884a9f1ad2607101d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc924be-5786-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638899434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899434, "uuid": "2515ac96-2b60-4030-afd4-2ab0d94c6ee3", "comment": "Malware payload", "value": "fd9dafcb1f13afb52b820e67503fcf07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899434, "uuid": "7d11908d-f067-4d60-92a0-bbc08a3175d0", "comment": "Malware payload", "value": "57bda91e2199572cc00cb017e6d3b7fb313b22e8a2f77875df801cc256af4dcf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899434, "uuid": "9cb37105-0838-4bac-a1e5-8d239936ead3", "comment": "Malware payload", "value": "c6c536ba5e83b81ec20a71a683b55832a4b809f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899434, "uuid": "a05761bc-16f0-4ef8-bbe8-fc00c3102e70", "comment": "Malware payload", "value": "1c8e4f7403cef61126e73c0c2b413869cb8cec2ebbc95ee0c5fa69794dcd3c364737302e38ce726ee2dd0722a712fa87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899434, "uuid": "eb8231b8-bb5f-42bb-ba00-cb76e3785fca", "value": "T10094BF00E6E0D035F5B316F89AB59368A93E7EA15B3490CF52D426EA5774AE0EC3071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899434, "uuid": "654aa3f6-fd4e-4a67-a01b-d126cf7437ff", "value": "4eb02e1fe9496df33596532c6e671ce9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899434, "uuid": "c2e9255d-0df1-4780-9a8f-1925ad559fdb", "value": "6144:F5OG5fWB7SL5JiarBH605WH8CStDHPphXhrlrFJuZ3DRgxvfOR02gu:F5OefWBj+wOtDHxrlxJuZTRgpORd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638899434, "uuid": "24bb5bad-079b-497e-85af-5ba4d14333f1", "value": 431616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638899434, "uuid": "fa43daba-efcb-4527-9c24-551f549464d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899434, "uuid": "4c9dd356-f2f2-4c2a-a5c8-de387decd3a4", "value": "fd9dafcb1f13afb52b820e67503fcf07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870c3c1a-575e-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1638882404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882404, "uuid": "82e4b6d7-b271-4084-8ac3-42895e8a54b4", "comment": "Malware payload (DCRat)", "value": "b564e94788be6fe405f151fd61e03ead", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882404, "uuid": "6421cfe9-587d-4df9-8b7f-2dc7c46a097f", "comment": "Malware payload (DCRat)", "value": "57be9ea564e89060974355ae8938eb568be3195b91a9a45a5d2c6fde1d560d51", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882404, "uuid": "ac98156d-21cb-4259-844a-fcd46eed458f", "comment": "Malware payload (DCRat)", "value": "78704416bce0f93726eaaf9820e9172ec299f4e9", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882404, "uuid": "a96261d0-ef05-42d0-994d-ac644e4ace6f", "comment": "Malware payload (DCRat)", "value": "56d5777950f9ac740156e9d296ddc087eea95f1f6f718e30b27606d127a660da7c1b3a3c2354f830698714465b7752be", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882404, "uuid": "8489b980-99ef-494a-846d-411dbfd51d5e", "value": "T19CB5CF113E84CA02E12A563BE9EF805447BCFD416E62D71A7EAF339D25513A71E0E1CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882404, "uuid": "74053352-6259-4dd6-9200-3dd630db6257", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882404, "uuid": "9d8cdeda-e74c-41eb-afb9-1c5d1b2b15a5", "value": "24576:tg/TM3unSV8JHYj0M14oMKhqN8+r/tse9WPJXelRWjq+jPx8FT2t6nTtHtO3g4Jc:mQenScjKkr/y+qXeliq+iT2t60g7Er3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638882404, "uuid": "2bbdf3d3-df0b-4fc2-8f23-abbe65220fa4", "value": 2341376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638882404, "uuid": "d69696c4-5492-4bc6-ad21-88302b6f892b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882404, "uuid": "86445f1f-8fff-4187-8383-7c14cfc78720", "value": "b564e94788be6fe405f151fd61e03ead.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45899b7-5773-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638891607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891607, "uuid": "d271d05a-ebd6-4ee4-a9ab-7eeeda0ed490", "comment": "Malware payload (Heodo)", "value": "240be5bd62254159386914596778a23f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891607, "uuid": "ccf3b8f8-f14f-4fed-8404-677029fe4cd0", "comment": "Malware payload (Heodo)", "value": "57cc6203df97f2bbf43f0b76befacf9c83ce7edf522c5558467b75968c9a2238", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891607, "uuid": "8bc81156-5f5c-42cf-b4ea-602215d578bd", "comment": "Malware payload (Heodo)", "value": "5b80aa303ccb399655e4147e6d39425ff8bea613", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891607, "uuid": "0271da66-2485-4f4b-8e5f-10b32ac9f2e2", "comment": "Malware payload (Heodo)", "value": "093f026360ccd9ff4d14490fa25b9ef97425905acb679e82a183eaa047c4abe5d376548043cb851634d27accb89a935c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891607, "uuid": "88f077e8-8923-478d-9247-55a44ebda08f", "value": "T1BCF48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891607, "uuid": "230d39ac-fe85-416f-8f9d-72b9bc2f6b94", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891607, "uuid": "3b30ef13-df15-4d32-9b79-50f14f134690", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/2:JapiKiBEmj4GbOX399Md9J/0Tw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638891607, "uuid": "9ff136e2-0aec-46d5-8ef8-80b11bd50579", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638891607, "uuid": "185f9c52-017f-476c-88f2-c317e9126411", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891607, "uuid": "9f3c1038-6373-47ea-be7b-6f9b3f091718", "value": "wTlv.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3073ec93-5750-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638876246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876246, "uuid": "7357afdf-5fb6-4de8-83db-fb031ab1f0a0", "comment": "Malware payload (AgentTesla)", "value": "7d43e08ae3b9e20451f1a5a17e9534a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876246, "uuid": "27eff9cb-2140-4674-a776-6033b7accc84", "comment": "Malware payload (AgentTesla)", "value": "586c7eddeb7d6b8d9234a554ba08ed1d09bf2b1fb660769d937fe4c463d98ca0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876246, "uuid": "7d12f7f4-a5c0-4e9b-8e74-a77b0043ea98", "comment": "Malware payload (AgentTesla)", "value": "340fce367b16254585c1c18c3a14f55b670e9a4f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876246, "uuid": "3ca0dd4a-9a01-4697-8e83-2615a3e8939c", "comment": "Malware payload (AgentTesla)", "value": "0397a740725cefb291f6548b9806a4d6c164db3ddb3545f9b966f547a1cb913bd8b10886d079c050da9e4fe3c04d93ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876246, "uuid": "580f37de-eb4e-43aa-bc6b-786123539d25", "value": "T1C792B4ACC4970298CF456BB06B2BAF98018C7A6CF784987375BCA77117D2D7A911683C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876246, "uuid": "5fefd015-b035-4c9f-a602-dd858f6d1074", "value": "384:tPT5CUvEfH571bxhS3UqKT9t4Yt804BHuw+vAIWt37VFn1ZovjinAicH3FFyn:x+Hth4kH+OxWlDIiAxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638876246, "uuid": "7999a5d9-7247-4351-9f11-49cb48c52931", "value": 20039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638876246, "uuid": "26ba9062-db0d-43e9-88ec-f0838b067173", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876246, "uuid": "e421f54d-56a6-4de5-aa5a-8f268b702829", "value": "Order RFQ 864958.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f9ff942-579a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Zeppelin)", "timestamp": 1638908000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638908000, "uuid": "ab9e00d3-4c50-4017-a7b6-cc5bb589d5e7", "comment": "Malware payload (Zeppelin)", "value": "66b9986303e0ad7dc37c629a892dcdc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "Zeppelin", "colour": "#9BEC2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638908000, "uuid": "826a086d-f8d1-4db3-8987-cbbbb4b7c6d8", "comment": "Malware payload (Zeppelin)", "value": "5876685b455f0c3f0228d03744b34df3e38add056fdbe111f639eafddf4fcc14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "Zeppelin", "colour": "#9BEC2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638908000, "uuid": "81470235-e6ff-4217-a09a-8f09e341739f", "comment": "Malware payload (Zeppelin)", "value": "9c2671507b9e71a2d799f93bb51055b35d3a681b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "Zeppelin", "colour": "#9BEC2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638908000, "uuid": "552fd94c-21cc-42c0-8901-3bbf41fa2022", "comment": "Malware payload (Zeppelin)", "value": "66d872ebc7ff58cd4ca208e00caada02da5a97952cc258de6a05001065d061fcbc16e0a69885b09e6457e4601ad13772", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "Zeppelin", "colour": "#9BEC2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638908000, "uuid": "2f456af2-5af2-4021-b9a5-0290972122e7", "value": "T10744E0DAFC0ACC65E2CEB931042A4F48733BED1A1761E64635673B41597B1F0249AFE8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638908000, "uuid": "a6164622-12d2-4f4f-858c-593e45fb16bd", "value": "f7023dd7fb9e445f38fcd83e7edb3f9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638908000, "uuid": "b866c3e4-96a1-48b3-99b1-80ff4167b28c", "value": "6144:PWfM6iKwtADM5njFGKfi/Xm51QCG8VG1XhmIQ4V:+l0LnjFGKf351rGagwh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638908000, "uuid": "02958b70-84ca-48ae-964a-fcbf8403a904", "value": 256044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638908000, "uuid": "0887f8e2-396a-4162-919b-e8132d128c9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638908000, "uuid": "a2cf53c3-1a73-4bad-b000-eea7766c4e47", "value": "11409.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8891898c-5724-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638857496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638857496, "uuid": "bd80687b-9471-4ce6-832d-77a63b126484", "comment": "Malware payload (Loki)", "value": "e109af7d9f5ec4c75acebe6e54a94ce2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638857496, "uuid": "e5ae4e78-45b1-423a-94ac-49a91eab6d2b", "comment": "Malware payload (Loki)", "value": "5a34fe215cbc5f45a4f9faab0b57dcac5ce695d1d298f8899e22baf363d39dc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638857496, "uuid": "5d6d8e57-3765-4cea-a32f-d3332117538a", "comment": "Malware payload (Loki)", "value": "085581a597d15da1a36b74d4169e924e90471754", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638857496, "uuid": "957b6ed7-8e14-47ff-88f1-5e71420bdbc1", "comment": "Malware payload (Loki)", "value": "4fab6d5e9da1245fee28d604e49c6868dcf7d120a56fd7faf089fedbaba940801dca7952e400c51bff58a7e8e219b195", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638857496, "uuid": "ff761457-f699-455d-a71a-6ecc198b393d", "value": "T1A215231053F94374CEED2BF67A1460B107BF99696812E75E6EC111DE32BAB889B80743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638857496, "uuid": "f32ae936-fcdd-4680-8815-44d12ac84acf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638857496, "uuid": "45103de6-06b3-41b2-a555-e3ca4da9ca5d", "value": "24576:/fsQSPhfJ9jsuezPFR4WTFFIWTC0PtE2FrRiKD:nsQSPhhlsuQ7TFR+Yq2FtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638857496, "uuid": "103896b9-e895-47a3-ad22-c2bddb85b44c", "value": 885248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638857496, "uuid": "ee29fa33-e8e8-4bef-bb97-732fb6a991d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638857496, "uuid": "52fd4db5-e810-45d6-8d6e-00359cca8e52", "value": "DE00012599.BAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a50696-572b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638860516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638860516, "uuid": "668d6b0e-8d83-4bf8-9638-c7610cc399a6", "comment": "Malware payload (Loki)", "value": "88f4f088899257331f22db2b267c49b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638860516, "uuid": "e23d8f56-67a6-4412-8b67-3c1f1ea7ca68", "comment": "Malware payload (Loki)", "value": "5a3e05cc8140c58c6ae54ef96b726368210f5e1635d1fb4902161db57ff174ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638860516, "uuid": "2f8b7d15-2594-4498-a21a-0fcc43ea876f", "comment": "Malware payload (Loki)", "value": "9acf64a627e8630f6494e7835eba0b0412d72711", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638860516, "uuid": "90234cdc-c19a-4fb5-9782-5816e3172d7b", "comment": "Malware payload (Loki)", "value": "be58dbc4b7223e890484376172f8044299645975e014eae17affdb77645c939f221240df6b42f38e13a588bcceaa62cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638860516, "uuid": "ee9eb696-7b24-400f-a642-7377b1023723", "value": "T1DE15230633A98B35EDE857F24040466043FBAA4FAA82EB276DC4DDDD3B77785C680197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638860516, "uuid": "34c7d581-9c9d-44db-b201-993aadedba20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638860516, "uuid": "5c167e08-42b6-410b-ae8d-31a2198e34fc", "value": "24576:zbS1iV7F99htQqfn4oOzH+pf/HIwB2zyUpE52:mif99h20OzHY74z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638860516, "uuid": "91cbe470-783e-46a6-a8e0-ce05bb1e57fe", "value": 954368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638860516, "uuid": "6c543eca-0e21-4e01-ab4e-d853b4336b58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638860516, "uuid": "95e7c87a-7a20-4751-923a-5a84de888e69", "value": "ED09324848.SCR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b75a60-570c-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638847017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638847017, "uuid": "4c8a2b10-fecb-4e19-aa47-836132a1e869", "comment": "Malware payload (AgentTesla)", "value": "eeada87ccdee6621a80039b8d2e5ddda", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638847017, "uuid": "203914b4-77c6-4ff6-8f50-331a980e1ef0", "comment": "Malware payload (AgentTesla)", "value": "5aa0ec43a3f16af9784588bdcf6b78b54159ad68da93d5eb32a0433f6637affb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638847017, "uuid": "975be16f-1776-49c0-b98c-e4c2f4a5832e", "comment": "Malware payload (AgentTesla)", "value": "93801a4abd90e1e6c22c4b943f9c7c73e8ea88bc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638847017, "uuid": "ccfc05cb-cfc1-465c-98cc-403a603eb7cc", "comment": "Malware payload (AgentTesla)", "value": "77eec45d3ee03474098e22fa9947b35e82fd34b3b0cbba17255b56070640a2459c589f6971f08ce6fd7fc5e98f8355fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638847017, "uuid": "c4521c56-da0f-4a55-9ca0-c39ab7453a7f", "value": "T1DA35232637988033CD755DFD50A3605213B9993E2ACFF7AC6CC1AE5936E93C9520A387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638847017, "uuid": "e549a3a8-eb1c-4aed-8302-ec5686923741", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638847017, "uuid": "21bf0fe3-198f-44ae-ada2-2685a2856d45", "value": "24576:sIiuMm0Ksxhpp1QCtPJWuSyIuQBT0QflMTBF:dcmGxht19QB/m3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638847017, "uuid": "9ad61233-34ce-444f-8e2f-389fd115b17a", "value": 1105408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638847017, "uuid": "2605c3bb-591c-479d-91ed-3dd1feacfbd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638847017, "uuid": "9b07f113-bbbc-42bc-8cc4-3375702c9308", "value": "00041221.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afbd6919-57a5-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638912967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912967, "uuid": "3b3e887e-5129-4410-aab6-e06ed0b0dfe9", "comment": "Malware payload", "value": "29ab2e7708d6377ae2396ac0c6a08e59", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912967, "uuid": "7c1ba48f-6e13-4428-86d1-10ea62bcd918", "comment": "Malware payload", "value": "5abaa68c979f7fa1933cf02b421d99e8109494c6038fd4eb3c9f4f338edfd7af", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912967, "uuid": "136bba3c-3932-4057-b1a3-396deb12686b", "comment": "Malware payload", "value": "53d2f64896aa90901a097eba623d3855fa3f7896", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912967, "uuid": "26861d9f-b8ed-47b3-b755-c0b401792060", "comment": "Malware payload", "value": "9880539577367f57d7fafff635bc5f07e81e680a004399cbd2d1a4b497690adbf39a8134a779c23e8b06d1b03d175b8b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912967, "uuid": "a4f0388b-2455-4644-b7f5-19af018bbb45", "value": "T1B1A5334893011525C2B6DC7B242525C17BAD6DC0C7607ABEB9AF3E854BBF0D04FA69F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912967, "uuid": "1d481e8b-5e9e-4d35-8573-c3e7bde6cb65", "value": "49152:Pr8atmpzTHEPkdKUMB5dNZhWbJb4SwF9w/elxu98GMsDvE5jX:D8r5THEPUa75Q4SywWY98RuEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638912967, "uuid": "4d38c56c-b91f-4816-a417-8a58359e3b11", "value": 2173204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638912967, "uuid": "b2e6f2f6-dec5-4456-aa3d-cb59f8c9216a", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912967, "uuid": "9a64b37f-015f-402b-9e7b-c1b425a9e050", "value": "Android_Guncelleme.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63364479-578c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638902101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638902101, "uuid": "2d44a4c3-e3da-4391-9784-7113a7fe95aa", "comment": "Malware payload (Mirai)", "value": "83142588e0e35472f36f17f00564a928", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638902101, "uuid": "aa9e95bc-65ad-4cc8-8feb-c67a9bc6d7fd", "comment": "Malware payload (Mirai)", "value": "5ac97f58e3e6a6d2a2570a0dc7657728104dff105e47004aad34d83c3f06a649", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638902101, "uuid": "b2c48428-956b-48dd-a81f-46c6dbf42a7d", "comment": "Malware payload (Mirai)", "value": "5af3d09c9bcc34c9b4edb7203c1c83838f10d8cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638902101, "uuid": "3c11670d-c357-482b-b0aa-3ed296fb56f5", "comment": "Malware payload (Mirai)", "value": "116a732b8886295a51d526c56276eaf8efa5e1fbead07ebee515ec44ceed3d4e589b69df242a29afbe8127418f86cc14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638902101, "uuid": "c898e2a8-1a5b-4c86-9d69-8592721e313a", "value": "T12A73831ABF654FF7E8ABCC378AA91B0124CC651A21A97F797930D814F24B24F55E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638902101, "uuid": "0a5aff71-00ff-47fc-96f4-dc9f0f6b8640", "value": "1536:7p/bgkjaVYjj/q6mI7MZz4ODnu9d6dPRRo1/:7dbgkjaVYH5QZz4eP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638902101, "uuid": "38691e90-f1a7-493d-bb0d-7d477f7649a6", "value": 76476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638902101, "uuid": "0b3bc9e7-d3e4-494b-8f4e-4eb711c1d927", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638902101, "uuid": "911d56aa-50c5-4793-bc19-9ff4261ff302", "value": "83142588e0e35472f36f17f00564a928", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eceff12f-575c-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638881716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881716, "uuid": "6167ea29-d25d-4062-92b2-03d89f7e3b67", "comment": "Malware payload", "value": "de9d7afe742c551522bafb785c706f4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881716, "uuid": "4df45fc5-34cf-4c47-a5ca-b8845f6eb835", "comment": "Malware payload", "value": "5bfba90917bc5e5acd1b61ac2ffdcbbd8fec71eb7fdfb0b681207cc2371d5b94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881716, "uuid": "0ca21d90-0323-4b40-be7b-9bf1f95cd625", "comment": "Malware payload", "value": "42e476b69971ee796704f5975aaacd2ecd38d9d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881716, "uuid": "18497873-081d-47df-a5fd-b86f19a45bb2", "comment": "Malware payload", "value": "6635e8f21529b556dce5c755b1df7c8c36fed43301e7cfce20783b240215bbd96aabcb155b1b5ca37d178277ff6d51f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881716, "uuid": "5fcf9a17-0d40-45c2-905f-09700733c781", "value": "T1C545E98C268947BB9906B1BF13134932F2E5D353033226F649269E57C9E1BA5FD3E4C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881716, "uuid": "97e1315b-dfaa-468a-9965-b43919314e5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881716, "uuid": "4ee7348c-75f1-45b1-9b58-2f4187a9ec21", "value": "6144:YzmH5qfVHplUuHYm1a6p6M9fo/+fUTDOO5CogUhn4Mnhv8gUNvOd0jq4QPT5u4BA:jbGFXhVcB/GvOSjqJz6NLlUQArccYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881716, "uuid": "4d3a66b4-9630-484d-a128-2476f736b015", "value": 1268224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881716, "uuid": "fda5067f-2e18-4a23-9a76-86ddc79f7101", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881716, "uuid": "c883120c-13af-44ac-a19c-e28b54d2ecbc", "value": "de9d7afe742c551522bafb785c706f4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d9b781-5779-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638893816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638893816, "uuid": "84d81694-f3a1-4aaf-b935-123bf6065993", "comment": "Malware payload (AgentTesla)", "value": "e0da4359b22cc0ce70cae3bd414278ff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638893816, "uuid": "49f0579d-6209-4fe2-b81f-9c9afa8c2860", "comment": "Malware payload (AgentTesla)", "value": "5c4394371eb274c1b7cd7e866a33d9d03fbeed0e491dbb6b668c6aab1c25a370", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638893816, "uuid": "791a3b11-892d-45f9-ae76-880186a54e8f", "comment": "Malware payload (AgentTesla)", "value": "1c1092eeae3181bc3efc7c4686fa0fa59df027b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638893816, "uuid": "bbb203f6-17db-4cd1-87c2-e3e492618ab0", "comment": "Malware payload (AgentTesla)", "value": "1973f1a40bc50630d7411753c0c0f71a3eef833fa4d081ba871b238e8f85d40cf89a91b6ef8ef69d6f70976acd0cd823", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638893816, "uuid": "f61b3b25-d87a-414d-9385-4efadfbeeeee", "value": "T13E3522AD3AA758CED4E01678736EC07802BA3C329417D75EE49E329F0033795367366A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638893816, "uuid": "91d0bfed-8b76-4c1a-809d-ac46ce3cd99f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638893816, "uuid": "b27adfef-96a2-42f3-a1ff-03653a11e30d", "value": "24576:NjP92aIAvttNmAFqa18HvTUSBqX6ORC4aqg22KnH63AMu:NkaIuk8qa18/qqowQHOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638893816, "uuid": "e3efb8c0-77d8-40ef-beb7-e97ac9e426aa", "value": 1125888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638893816, "uuid": "2d227bae-d4d5-44b7-97ed-2182a1e1fcd2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638893816, "uuid": "3b32a032-b900-4b5d-9f9e-387d04a86a2b", "value": "DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf7b715-575d-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638882037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882037, "uuid": "d8f7b6de-8ad2-449a-bad6-a04124f1feeb", "comment": "Malware payload (AgentTesla)", "value": "abd99af73e7aabb607379127985b57ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882037, "uuid": "7060848f-3b2e-4f06-aa50-1895c81eb91c", "comment": "Malware payload (AgentTesla)", "value": "5c5975bca5675caff4fd0cd1e014e118811fb1c52d217c0fc6e57173fcf47aec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882037, "uuid": "c2775211-007b-4846-bd0a-4495cd6bb729", "comment": "Malware payload (AgentTesla)", "value": "7e174f5ff40986d7eab4d5b4d4f79f6cf688320a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882037, "uuid": "56a11de0-a6f9-4b29-a668-b45ebc42d597", "comment": "Malware payload (AgentTesla)", "value": "86867eed7895f3759113f6b43b88fb774cfb518398dfb4aec1d3106fdb5e4b9a0df12de93f184b17a28e3425dc71c799", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882037, "uuid": "faef4464-6cef-4670-ba2a-b300ca894dca", "value": "T199E4D02036C3D2D5F87EDBB00FB567A106B5BDF8D8D0D39EE98831164A73391690917A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882037, "uuid": "f182e07d-c48a-4af7-895d-17a80ffcc318", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882037, "uuid": "090fd673-a263-4f75-8abc-067eb6154e58", "value": "12288:D4na2iNvyHI9sOnZjQgZ03Txk7gjIkDCy1NIOdQVYJUEKl75jQWmc:D4na1Zyo9TZ0gOWg19IO2VYJUEKlCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638882037, "uuid": "fe45fc2b-5b8c-495e-bb40-d36bc97bfa46", "value": 722432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638882037, "uuid": "a8ec7e33-2c64-44e4-add3-b480fcf7b2d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882037, "uuid": "139a9e56-df96-4b87-9607-b84b390e6eff", "value": "statement of account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b520ca-574f-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1638875778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638875778, "uuid": "9b80fc91-73cd-4bf9-a27d-917e458de99a", "comment": "Malware payload (RaccoonStealer)", "value": "c58ab85e86005430cf8b4eb02d203271", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638875778, "uuid": "d1676dd3-39f4-4222-9148-6b3adbb954f4", "comment": "Malware payload (RaccoonStealer)", "value": "5c69bc614c6092798cecfa808358e97cda7c0ea53f30e1e124cb14b54cf9f1b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638875778, "uuid": "d6b10aed-1a6a-4d4a-b971-45f87d704b8f", "comment": "Malware payload (RaccoonStealer)", "value": "2a8c22a93cfaa5b52d70ccba5a86107dd7955673", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638875778, "uuid": "ad1d4d87-ec56-4165-8bd1-71fc5e0928f5", "comment": "Malware payload (RaccoonStealer)", "value": "3690672a166eb2c832aab4a5337dd15255aea3f24fb343b524d56e57d7a93a2908f6b6232a03d38c1eda2ebd7e873f90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638875778, "uuid": "ef77a518-13ef-4b50-82f3-df53d9432e86", "value": "T16694BE00E7A0D034F1F316F85AB69268A93F7AA15B3454DF53D466EA5B34AE0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638875778, "uuid": "fd63ecd3-d546-40e9-a3b4-2098d3b3c276", "value": "bd61429d86f194f3b84d97af55b8c371", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638875778, "uuid": "dcb9487c-2207-4d87-94a9-1b92fabfd7dc", "value": "6144:FM2cWRAPqsIQdzjAGwEnaOv7ghZnejObWULlPJgePsmUTJhuo5J:F9RAPzXtD+nUObW+lPJgekmUTmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638875778, "uuid": "201b20cf-21bd-446b-8588-8fb7d9a261f3", "value": 432128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638875778, "uuid": "b73d448f-4148-4377-ba69-97bab4c47aa6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638875778, "uuid": "f50837aa-3422-4524-8534-2e817af5f675", "value": "c58ab85e86005430cf8b4eb02d203271", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451e04f1-5751-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638876710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876710, "uuid": "0d4cf511-df8b-4085-a945-705c26b736b5", "comment": "Malware payload (Formbook)", "value": "3737a03210bde0eca1c551430c8eca10", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876710, "uuid": "2979b52e-94e0-4eea-9d7b-543261e15893", "comment": "Malware payload (Formbook)", "value": "5ea89ec6f9fabf04beb6b7542099292964cebfbd67c9a2a7549229d6c6e53af1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876710, "uuid": "ab8beca5-8390-4aaa-a74b-43cffd260137", "comment": "Malware payload (Formbook)", "value": "b31e55920a96ddd77744c477da1ed118183836a3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876710, "uuid": "1bf73c1a-f399-4462-b921-194d0881282d", "comment": "Malware payload (Formbook)", "value": "2109de161ea7ad1e666512be4c91c0ef5c3753b231cccb13f754a48fd885ca62d1fdedd9dbccc8bf04e2decf74637652", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876710, "uuid": "d92f6757-f545-4865-aaaf-039641331aea", "value": "T1403412753863E30CFF5EF67446E0F139019AAE1D0E44E1EE90273A28DEF4EA62545627", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876710, "uuid": "f475f935-e881-4cb8-a6cb-888eea3dce8f", "value": "6144:CIYBdl7I5500oZwHlSTMNGOq5Sn43JxH3ONGfgox:C/FHXIlSTYIvX8Gfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638876710, "uuid": "d1fe450e-5019-42df-8d33-fd0262b97438", "value": 234488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638876710, "uuid": "9c0a57ae-c782-48db-8e19-3ad7b909a049", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876710, "uuid": "b2254ac9-206d-4d71-8a97-d2db79428227", "value": "Draft Contract.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be7cd7fb-5755-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638878632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878632, "uuid": "76cab7ab-5067-4648-9456-3d3b07366701", "comment": "Malware payload (Mirai)", "value": "50faff879dec91a945b1f4cb4d555143", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878632, "uuid": "30df1571-ba21-42f6-ad91-33b695539cfb", "comment": "Malware payload (Mirai)", "value": "5ec3c031daf5640e326a727bfb8fe6ba534b0e064e75246bb060389e6f5b7218", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878632, "uuid": "f8941cf9-6f5f-4869-8713-42618bfc3768", "comment": "Malware payload (Mirai)", "value": "4ed1bd9e406121d783bfba161a6e0b644e94b7f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878632, "uuid": "2c850a9d-e839-412e-aedc-9abe8e3668fe", "comment": "Malware payload (Mirai)", "value": "feb1689bd7f6efccb7cb24c47a2f340dd55be013963fd8918480110e14e5ce2d1d208367364f9ef36711b2764fcf503f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638878632, "uuid": "92bbdd08-bab9-42bc-8ba9-98abdbd815a3", "value": "T18773E91E3E219FBCFB9C863547F78E219658379626E1D284E19CE9011E7034D742FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638878632, "uuid": "06baf17c-2d25-4335-b249-ec91ee8344b4", "value": "1536:bVNDbOvkEDFaxZ7iVJDkzH0e9/oxS0gn+ZeQjM0pf87Cxcit:bVNbikL7iPkzH0e9/oxueeQjzp0de", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638878632, "uuid": "40b3c229-68ad-487b-81e7-1ce581cff7d7", "value": 77300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638878632, "uuid": "f5880603-a134-471e-ab95-49becac05bd3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638878632, "uuid": "977b21e9-7b6e-45a2-820f-a01005a65fdb", "value": "50faff879dec91a945b1f4cb4d555143", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8409cd3-5703-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638843429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638843429, "uuid": "2e5b1d05-8dd0-459c-a8e8-3e04e93898aa", "comment": "Malware payload (AgentTesla)", "value": "de6ad0f868a334ca2d7d4e1a13f4d2f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638843429, "uuid": "27d6202e-1486-4563-923d-dcdb58d76028", "comment": "Malware payload (AgentTesla)", "value": "5ef011d1c662dae8b242a1a1c2111c5d18805352b65658629088bc3aa7d434e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638843429, "uuid": "a9eaae33-1d00-4983-aaf3-45772112e4a0", "comment": "Malware payload (AgentTesla)", "value": "1b1f24527cf989643eaa672307985156b6ad7990", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638843429, "uuid": "23aa47e0-c766-4416-a912-37f5a12a74ff", "comment": "Malware payload (AgentTesla)", "value": "c0de87662e85979ad5833b6c7619467571427a16f30e0670258ad99c924365ee5f06ea7952fe6f9250ea57e3c3fa0919", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638843429, "uuid": "82cbeda7-8edc-4b20-8e55-6e381df558ef", "value": "T17CA4D04539DAD6A8FC7FEBB50CB171C503B8F2E4F941E2EEFD84249A98A27514E00572", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638843429, "uuid": "ddd03579-7423-464a-b6ad-1d197882f54d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638843429, "uuid": "974c4f31-3180-46f1-8bb0-de070f42f970", "value": "12288:hBsa2iNMrb0VUokScWnA8CdN1mmbHxoYRPVf:hBsa1mb0VUoZNA8QN1mUxP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638843429, "uuid": "0cdbf3af-890d-43cb-ae53-4e43fe2a2f86", "value": 474624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638843429, "uuid": "08b3048e-6fa8-40e4-8eb8-b7a9947293a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638843429, "uuid": "0973da66-4579-4718-9ba6-76b4db088dd3", "value": "PROFORMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f64c55-575e-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638882300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882300, "uuid": "0ae2331c-c6f4-4ba7-b721-2082de795d79", "comment": "Malware payload", "value": "f0e45bac527285564bb7559bbe98e5a5", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882300, "uuid": "dd3cbfad-bbaa-4157-b0f8-50099ee8e7b5", "comment": "Malware payload", "value": "5f5caa58b605a3a0f3b84250fce5ed3a408d3b27f4f5f844c2a5865f018c7029", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882300, "uuid": "08aac39f-96f2-4164-8c96-07183ed23284", "comment": "Malware payload", "value": "9ac440981491e2b278ee7cd723cc895d0daf3891", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882300, "uuid": "f81cd23a-3368-49c8-a56d-3e0fab5f9cf0", "comment": "Malware payload", "value": "e1c5ba0ca7abe1ca2f625f2c9da9fbf215d9df1564fcdc41136329287dc1f7f9fb7de70556ee8079d7f19645c0c70c8a", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882300, "uuid": "a094b766-9b8d-4a9a-9e88-0c50dc562cd1", "value": "T17B9533F305D13C21D6E9A0722CD135FBD3FBB9291C89BD03A6E9F905041A51299A4FBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882300, "uuid": "cff43eff-90e9-4119-9a95-6fc9cfd30948", "value": "49152:P2ju9T+CfQHs936Vaxy/Q354oaZQPNXntSlDv4tqw1eVrnnp:PIucbHG36VaxOQRPN8dvGquMDnp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638882300, "uuid": "05f496e0-27fe-4053-bdbb-51236fa6a7b5", "value": 2024304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638882300, "uuid": "99f8d2e8-5323-488b-9d4f-b9cd7b2b8a04", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882300, "uuid": "5366c141-aadc-411b-aa5e-4c78337d5cac", "value": "TT Link 07.12.2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b75fa9-5755-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638878622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878622, "uuid": "4de52fe3-b1b1-4272-ba01-5c8abc46e9e2", "comment": "Malware payload (Mirai)", "value": "8fa88304adfbff1561b36a85a384acd0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878622, "uuid": "e873deb0-b1c5-4cac-b4d2-bea6b824b5aa", "comment": "Malware payload (Mirai)", "value": "5fd6409b72ab59cd87ca758f7a5dfbdb304b300ec38cb38598a78f2de8855d90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878622, "uuid": "3a23b5be-dbd7-4a13-aff6-3ff819663b30", "comment": "Malware payload (Mirai)", "value": "7abd43b5d506b92c1d6b91a97d002dbd97c37f5b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878622, "uuid": "eea6ca46-d502-431a-bac5-aeeee76a3b6d", "comment": "Malware payload (Mirai)", "value": "9601186f38d092154a2d0d7ae2fa9b2ca4a3ad5d79b502d3390574d2d18feb06d49daf2c7bd945f2ac41c694cd1f165d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638878622, "uuid": "bbe591a4-dca7-48e6-8500-32401271c5b7", "value": "T1AE73A40ABF611FB7E89FDD3749EA1706298C551A22A93B757E30D818F24B24F15E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638878622, "uuid": "22652094-3e39-4af2-adf5-8dac9a2f5b65", "value": "1536:6qJw3YsQg0RG0b3FbBSsZjZLwZXmhaGAYxc3:6qJewtRG0b5LwV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638878622, "uuid": "7fb79edf-fe25-4ee2-acd4-128852fe2681", "value": 80052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638878622, "uuid": "51ab7bcf-7d23-460c-96a5-ea2cec58d30a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638878622, "uuid": "96ac46ea-f12f-4e6d-91cd-a5070e9d64fa", "value": "8fa88304adfbff1561b36a85a384acd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc730d5b-5770-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638890332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890332, "uuid": "b1b1b19c-be57-465c-bc6b-611aee434a2d", "comment": "Malware payload (Dridex)", "value": "3b1b0bc447de4a74e2d637d3b8244763", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890332, "uuid": "1f9b4c12-9927-4b33-9bf4-9ef2a16d43b6", "comment": "Malware payload (Dridex)", "value": "601fc1c2583f234a213022b8c4ea5ec5fda60ff7d0bee939ca425ac89787892a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890332, "uuid": "cb05a113-28a0-46b7-8f51-dc16ccb92066", "comment": "Malware payload (Dridex)", "value": "6bb973d8b5f4726482c2b53aaecc5a21f339a777", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890332, "uuid": "a568b4bc-9c7b-4110-8e99-e2c7a1bf75ff", "comment": "Malware payload (Dridex)", "value": "ca0e4b50bf9a54f7aabe74543520db3de5063be0360d90e3a6c0381acb134d5a386baf19d135e1fd2d828c3e69ea84bb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890332, "uuid": "6b50495a-bb3a-442b-a7c6-1e045a37ee99", "value": "T118246E81AB7799B6CA21F7B5CD4D1A90D371DD0A979843FB3664222E3F305B0EC8C499", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890332, "uuid": "77fe4327-4f2b-4348-99a7-7a7d94ebde92", "value": "6144:M96FE76hr0d3n98AdwL3x2bVyyKC7A6R88T60ddYYZ0jB:wlT60dGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638890332, "uuid": "afa5c167-bc4b-43ed-98ea-263264e63d09", "value": 214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638890332, "uuid": "5a8daac6-1c77-4ac4-a943-c82b15f9faea", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890332, "uuid": "ddd44824-03e2-4feb-a8db-df58cdcf8924", "value": "SecuriteInfo.com.Heur.20807.8698", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c76cba-5772-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1638890942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890942, "uuid": "21b806b5-31d0-4d2e-88b9-4a5bfd5e1785", "comment": "Malware payload (ArkeiStealer)", "value": "0c1da4264ad1c6f7412002e74e6e55d9", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890942, "uuid": "83af7529-c0a7-46b7-806d-c737d36c55f6", "comment": "Malware payload (ArkeiStealer)", "value": "6041f198fd6128b1e7cf23046b146a4f77053aa8d24039c1d495be51be29f0d7", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890942, "uuid": "260b312e-9ec1-4b28-9453-a1c0e1485a22", "comment": "Malware payload (ArkeiStealer)", "value": "d7216c84647464b886ba7186fd00b5c0a572dc1b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890942, "uuid": "578307ea-7c66-45e4-9356-faafa1ee4826", "comment": "Malware payload (ArkeiStealer)", "value": "78e75f7ef274e9e77e95ea5304c0324af6c49e1d94c929da3ec70285dad2ca4321e2fb52c3641383449b916d6ccc639b", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890942, "uuid": "e5bddb07-85ea-4ce8-a178-dac69fe46234", "value": "T14775F109A2FA5BC4FAF76B32997C62720F7ABD6169F8C10D1B1531190831E749AB4733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890942, "uuid": "47705bba-1e85-4a05-8abb-48afa9cf940d", "value": "49fab1bd01bfd7ab9afa1504f543eee5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890942, "uuid": "10d957c4-e228-4d0d-9348-acb8798e81ad", "value": "24576:un8p2QKeZ8ia1UKjZjw+gXRF5nFNbGl15gFy2LUzqY+Oqb94lZh8Ik3Sf:p2Qz8iaaea/71FNg15X5+zWlZhso", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638890942, "uuid": "bb79f960-e3d2-4c83-9e4d-7a06426ecff0", "value": 1656144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638890942, "uuid": "49ea4979-68af-4855-93b8-a625ded1ab14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890942, "uuid": "9d23555c-5835-4c9b-8585-0c890d798cd1", "value": "0c1da4264ad1c6f7412002e74e6e55d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d48a12-57a9-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638914403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638914403, "uuid": "7423c0b8-0589-4e9d-ab55-f71568a40080", "comment": "Malware payload", "value": "362da2a0cc825f25a1cc9c93665205d3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638914403, "uuid": "602281f2-3d76-4257-a3c5-3608089dc360", "comment": "Malware payload", "value": "60b1ab66c1e26e5b9bbecb5b9755bd77a8d39d3f6e32f05852dc6c9b47a486e2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638914403, "uuid": "baa462f3-20e9-4ca4-92c2-5b57cd2d05fe", "comment": "Malware payload", "value": "70ae79d0a9162e21aaf1926ed912331c4cc9f017", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638914403, "uuid": "98d97bf4-50ed-4487-9ef9-1f2c7566ddc2", "comment": "Malware payload", "value": "7508d6e6faab1d5c5c3a12b345737bf7aaee1e165f0d78530396fb8ca4fccd8a9eacc734ae3475a2404162d2e1bd545e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638914403, "uuid": "2e5af849-3af5-40a5-81e6-df4a0ba0c3dd", "value": "T1C234235F9CECADCC81C9A32310701E21D426C1984FA5ADA0ADA7719DE1F7B48DEDC92D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638914403, "uuid": "160cf222-8700-46b6-a83b-175d829cf128", "value": "6144:QIF82x2PtUBOMddnm9TgrSWsOUFjibRo7XSKHxC3lfMxrb85:v5CUBOWd1Otu1qXSg8hgU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638914403, "uuid": "c3fb005d-4c70-41ef-961f-b86b2df9ea40", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638914403, "uuid": "245b23ed-8dbf-43e4-a184-9b3f5778444d", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638914403, "uuid": "1a393d73-4e52-4d9d-a9e7-49ffc1819f50", "value": "60b1ab66c1e26e5b9bbecb5b9755bd77a8d39d3f6e32f05852dc6c9b47a486e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d13ed527-5747-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638872650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872650, "uuid": "5116e88f-c3e0-4d81-bc0c-d810884fc125", "comment": "Malware payload (Dridex)", "value": "7d7cbd8e78186a4f69569b3ea0b2b9b5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872650, "uuid": "1cb86930-f7c4-4338-b910-fc0f43fc1bd8", "comment": "Malware payload (Dridex)", "value": "614f3f54abffeaf195edde78e7e2403c0a665387cfa41c2200e5cecae91d7aed", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872650, "uuid": "6cc0c685-928c-4381-8fa5-34edd265c66c", "comment": "Malware payload (Dridex)", "value": "9e2b54a0cb514299730e41f4d0e4b2872fe00625", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872650, "uuid": "c7e1e53b-8b9b-4e91-8243-e5e37dbf0432", "comment": "Malware payload (Dridex)", "value": "182aa27d758488c3a4310ddd4742615331b56b9d471cc544aaee1e488a018de86e0898cb8486a35bb0003e7616856c10", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638872650, "uuid": "bd2ca67f-5571-4942-974a-0b3111b34896", "value": "T13D34F9C9AF7AD8B6CE81F975494F1E519372DD470A18AFE3294C32293E205B04CEB49D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638872650, "uuid": "47bb35a8-6406-49a4-b6b5-39d55ec1e856", "value": "6144:sW96FE76hr0d3n98AdwL3x2bVyyKC7AAj0uPDC0ddYY5Ij9PqOe:PLDC0duYq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638872650, "uuid": "ea796471-c64a-4c7e-a020-e08006268f01", "value": 234496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638872650, "uuid": "51ac1053-9d68-4c33-935e-92ed17de89c8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638872650, "uuid": "6a079344-e248-4afd-9da0-6161fa03f808", "value": "Bill12-2021-0441214.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e8695b-56f1-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638835594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835594, "uuid": "e1739216-66e8-4e49-830f-2eb0f7e71372", "comment": "Malware payload (Heodo)", "value": "84a277254ee6ac4221f02d1f8668d11f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835594, "uuid": "e7255f9b-1b40-4c0e-8baf-6d5c83921949", "comment": "Malware payload (Heodo)", "value": "624c44af10422caba69688cf5be5e647aa508a16cca8a1660adbeb07ce77402f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835594, "uuid": "7d973404-8fd9-4985-974f-3174d14b701a", "comment": "Malware payload (Heodo)", "value": "fa88da9543d37a94ac4abce6570017cf45559d6f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835594, "uuid": "1eb6000d-7dfa-4585-b18e-cb1c108b0b7d", "comment": "Malware payload (Heodo)", "value": "57a60977a16055f88a202de70d6a15f1df1689b7d0c2121adfe221eeaa16de1c2f9de84ea98c1ef076b2099f7b652f02", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835594, "uuid": "c76a5d59-113a-49c5-9b09-16bc2cb07492", "value": "T1EBF48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835594, "uuid": "be7aa1c8-146f-4f34-b71d-5bd585fea68e", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835594, "uuid": "3afa06f2-272f-4cf7-bbb3-e3aff269e698", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/H:JapiKiBEmj4GbOX399Md9J/0Td", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638835594, "uuid": "144777f2-20e7-4495-a321-a11e4fe35e09", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638835594, "uuid": "89472c7f-6260-4345-91c8-78481b414d4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835594, "uuid": "1bb302c1-8616-4d8c-932d-adeab6db009c", "value": "emotet_exe_e5_624c44af10422caba69688cf5be5e647aa508a16cca8a1660adbeb07ce77402f_2021-12-07__000628.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e7681dc-5720-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638855573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638855573, "uuid": "14295840-b47d-4064-9137-283a3856eacc", "comment": "Malware payload (RedLineStealer)", "value": "11b786511b4bf4810a4fb888387fe431", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638855573, "uuid": "922a4474-18eb-4671-86d9-f216ecaa4001", "comment": "Malware payload (RedLineStealer)", "value": "626db53138176b8a371878ebaa2dbbd724be9a74f9f82ef9ebb7b7bfc0c6b2e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638855573, "uuid": "ea42a213-635b-4a58-9e4c-54f51aa5d76c", "comment": "Malware payload (RedLineStealer)", "value": "8513043d3fdec628f515eef5d607c3be68e16bdd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638855573, "uuid": "60a72783-b5a1-43e9-b73e-3a886cb67541", "comment": "Malware payload (RedLineStealer)", "value": "b37efd08f52384a18b83e46b88d5c0490cdb7112ea0670ba6a3ab1f114109e8b4bd07d782ed3992cabc15124dc045169", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638855573, "uuid": "79c72d53-3350-4d29-8959-3a9398c8eaab", "value": "T122E5C022A3825437C27237F88D1B53A55436BE312A64B9BA3BF52F4CEF315413B25297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638855573, "uuid": "c1dc30d3-4b88-45cb-a086-47ca33593504", "value": "d7ffb787b8c3479851de64d8fdb945a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638855573, "uuid": "be516a89-bc3b-440f-b216-55f423c2d860", "value": "49152:7OMy5lW0hR+E0q6UoAAazXZDBRQySswRMMnWq:76lW0t3AmX6pswRMMnWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638855573, "uuid": "173f3cd8-6df2-47c6-a347-a5fe4c99ac86", "value": 3255808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638855573, "uuid": "5c733d9b-7463-48b6-a4d3-1609c6077b25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638855573, "uuid": "383b0cee-6dad-4dae-9132-414e8a50bdaa", "value": "11b786511b4bf4810a4fb888387fe431", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ece3ba-5721-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638856203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856203, "uuid": "e762b358-b497-449e-8289-fd234b5255c4", "comment": "Malware payload (Mirai)", "value": "4a0868702f19e9250fd8a42550f33205", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856203, "uuid": "ea876a0c-94ea-435e-94b4-8a8a18f6ea47", "comment": "Malware payload (Mirai)", "value": "632227a7ac27978575ecdabc7f2e06108b725f07471b8b30d1e3ffba40abd953", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856203, "uuid": "25c2cfd8-3a7d-4394-a5c4-7eec3ce61ba0", "comment": "Malware payload (Mirai)", "value": "81eb9107059841fcba2ef601711e168d8449d6f3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856203, "uuid": "0e61e3a0-2fec-4c55-96f0-ad62f1d18451", "comment": "Malware payload (Mirai)", "value": "67fab84b73f91810bbb9e5bd139f30458bb8a015be9be501fefc6b430c2af765cd69d9588381f15f8fb6cfc79f714779", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856203, "uuid": "33f816dd-63af-49a6-9c8e-ab7090d590db", "value": "T1CDD2E1E42D49C880E78A003661EBECFB40FFB651DFE68D503971268B5C1D15F6559BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856203, "uuid": "a77e6870-290e-4b99-9bee-76602125e805", "value": "384:MyT1Up9d4nBwjsZJz/l38jpc+W2NhzNc2B0JYNKbhNxBgW8bbMZLnX1X/FD+v1RL:5T1Upj4nmwz18Vc+jhz2FbUFkRlmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638856203, "uuid": "e811cb56-dda2-4dc5-9354-5035a7399d2b", "value": 30212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638856203, "uuid": "7a2c60b0-057b-4c9d-9e2e-f5d9ee4d3da6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856203, "uuid": "09164152-da53-4aff-ab6f-06422bffe03d", "value": "Tsunami.x86-20211207-0550", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7dacc6-5741-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638869767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869767, "uuid": "eee98a71-ff9c-488c-a061-05360f6fdf65", "comment": "Malware payload (AgentTesla)", "value": "02f9b9973a66536d93d5015277e0dd57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869767, "uuid": "a523fbfb-6a78-49f5-b3b6-499dc1e5afd8", "comment": "Malware payload (AgentTesla)", "value": "63bd4f076246b7bcd8e2f35e88dafd43266a8468064fb7a061c4f489dd713787", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869767, "uuid": "810aa062-ad63-4f11-afbc-e078d23868ef", "comment": "Malware payload (AgentTesla)", "value": "9d6b8282756ac296a018bd11df390f1d424c2726", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869767, "uuid": "210a04ed-315f-4578-902b-d14ae509ca5b", "comment": "Malware payload (AgentTesla)", "value": "a892aa5f50db8e93210c6950405721232901062886c35d476aa95e5be530857cf933a0a88b9bd3081c8064f3145f34f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869767, "uuid": "711fddeb-4cb3-41d7-a426-995195e954ee", "value": "T107E35C65A290D6E9D062B7B0DD21F6BC402ABC37396108DB9EC377581A31B93C1E7367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869767, "uuid": "f95c48fa-3c8a-4a8c-8c0a-f4c029df4076", "value": "460340e2ce791b610d6d419830ceb88b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869767, "uuid": "e12c916e-0305-477e-b159-4395e0c6aa37", "value": "1536:kDqdK4J28KwgajWeC5FdV1OTlOsLQFEIkc04ts/4:vUo2PPeWeq/mXQUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638869767, "uuid": "e3eed1c3-e844-430b-a2d5-1dda15d69896", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638869767, "uuid": "eabe4f05-88ed-4310-ab11-5b76ebf3dd9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869767, "uuid": "16d77b1a-3333-4857-98aa-5765e2f78bd0", "value": "SWIFT ~0.SCR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e6ad36b-5720-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638855600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638855600, "uuid": "e18ec03a-a280-4442-ad36-8f16cc89a341", "comment": "Malware payload", "value": "eda13c070d79257b58c52c18b09a0f4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638855600, "uuid": "8bc8e821-687a-4fd3-9053-24dcfbfbd44f", "comment": "Malware payload", "value": "63dcddda06b70eb8f9ef6cf96c6c9ed79b99f2e53d9eefa44d76283f350c88d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638855600, "uuid": "61b4cb82-9678-417d-941f-de1f0d5a60b7", "comment": "Malware payload", "value": "7e23b295280b0c0d44eff4f862f7905baeed6a32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638855600, "uuid": "1936883c-d518-4b29-929b-af8c2c2e08aa", "comment": "Malware payload", "value": "cca1eeac7a0d26ee07252271a475dffdcb7231eba063cd9971bd68724a0df31c00477791d5c96f28c1707f15b5aec33a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638855600, "uuid": "b737b7d7-4b02-4f19-9796-137881aa67c1", "value": "T1047623FE21583354C01FC8389533AE56F2B6551F9AE8C56AB2DEBAC03FA7420C589F45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638855600, "uuid": "f502d625-5798-49fd-a5d3-c25ff4fdb3cd", "value": "dac5a88969ccf800c9b0d53e7753763c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638855600, "uuid": "b58f545e-0df4-47e1-870d-02e87687b7cb", "value": "98304:YqwTOg1yHGhn0GBEcjw4bWdt0XOZlvB85o7jIXqS7Ayu:e6C/hLENya0XOjB8+PIaS7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638855600, "uuid": "6f936088-5da0-49a8-9509-bf8a1fba428a", "value": 7169024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638855600, "uuid": "beeb7d9d-447a-4d79-8150-4244789d66df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638855600, "uuid": "054853b7-621d-495b-a941-72efba66e8e0", "value": "eda13c070d79257b58c52c18b09a0f4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6eae97a-5789-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638901033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901033, "uuid": "469969e8-27e3-4f04-95c1-6355658ef7bd", "comment": "Malware payload", "value": "3f49fbb29396e97ee7d905f610f5eb10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901033, "uuid": "7bb3eab6-7244-4923-a2a0-ef92a8c4a1f2", "comment": "Malware payload", "value": "6435d4b7d16a8e90e06412b46424a120189f25fa721c1140b49e64dc065ec325", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901033, "uuid": "32de6c56-1277-46ef-9ca7-c7a56d7304bb", "comment": "Malware payload", "value": "fc394e79cce49e844a72be4355bdd448704a2acc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901033, "uuid": "a37fb2ad-cca9-4d95-8880-f575f5a0be98", "comment": "Malware payload", "value": "718b13891658d7b159ebbbd875121050b3eff7a03049e211cebe30c9d2211f66826e7fd44a12f5ab6701284c926f7c74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901033, "uuid": "d3405828-5e28-4738-ab15-00b5597fda8c", "value": "T1713523AC3BAB95CED412927A77BAD06C16B57C33641BC29DE09B324F18333447A33656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901033, "uuid": "e8de94ba-04c6-4aa7-9e60-f16dffc05d82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901033, "uuid": "4e94b773-4409-47c5-b2ff-5f147d16778b", "value": "24576:LfOfudsNNAvwXvZCpZI3awFo8a5aHvPsCkX3LKRPT4a1aIcW51z:LWfuek+cpdwa8sa3k+5T4aAIcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638901033, "uuid": "47164065-8a45-4eca-b1e4-fb73bbd6067c", "value": 1130496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638901033, "uuid": "bd4c7b97-7ce9-4281-af51-9019226d7cd2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901033, "uuid": "0a39a30f-2144-4fd2-b83e-ca876b9be598", "value": "140085-Pending 07052021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099cfde1-572f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638862007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638862007, "uuid": "72e345c4-8da8-4af4-8a93-6944b2d7f887", "comment": "Malware payload (Heodo)", "value": "c20491106160efd0e9b91a0119d7e560", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638862007, "uuid": "fef0084b-0344-4bb2-9c24-1f606bb7f81f", "comment": "Malware payload (Heodo)", "value": "64d6aad492dc0bded832db142b8f12622e5af2025f3bc0cd6d5816409411fe2a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638862007, "uuid": "acd924a5-851f-4a13-8cac-2398e033ea71", "comment": "Malware payload (Heodo)", "value": "6981077762e449aa5d5c7e1b299acf35496715c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638862007, "uuid": "8a32fea3-41d7-4124-8cb0-83b70b3c0881", "comment": "Malware payload (Heodo)", "value": "b54172fe8c76a31fe3c618d9005f20b535680cf70cea3316b179d7a97a8bf911ad4a3c54e1e13564d4d0b3c2f2e267b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638862007, "uuid": "41d868a1-6aa9-4a70-889f-97c2cda1a3e0", "value": "T1E1F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638862007, "uuid": "ba2bd560-2ac4-4272-b3d4-dc68c2c0161c", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638862007, "uuid": "9480aac6-ea20-44dd-8b27-65992c5b5499", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/B:JapiKiBEmj4GbOX399Md9J/0TP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638862007, "uuid": "c0fbdb71-8968-4d73-bd90-c4ce0c5944f0", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638862007, "uuid": "4c78cbb7-72f5-4525-a840-167ef7614557", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638862007, "uuid": "33ad395a-7efb-41bf-a474-2e77653e74eb", "value": "c20491106160efd0e9b91a0119d7e560", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b2d175-5768-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638886750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638886750, "uuid": "a2346c5a-7d49-42ea-a4c1-dba204adfbb7", "comment": "Malware payload (AgentTesla)", "value": "9b5177fe132263496247ba949a94bee7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638886750, "uuid": "11b8a9fa-4511-481e-94d7-11568c5f5780", "comment": "Malware payload (AgentTesla)", "value": "64daf44a1d09c5b561ceca86d8602540874318e2f1a3c6a932a029cbb9fae25d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638886750, "uuid": "5a8a3c63-d3f5-45fd-9350-344559b8c278", "comment": "Malware payload (AgentTesla)", "value": "619e5b783de200459066c687053308f93dca8947", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638886750, "uuid": "559577d5-b6df-46af-8fa3-2946e21d2048", "comment": "Malware payload (AgentTesla)", "value": "b7d84169225989340261dc36e4ce2306e66023baf81930241893bcd491ad1fb8dd698ee07326ad0e062797672bcd00b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638886750, "uuid": "311b3d41-54bf-4cf0-a9c8-d41291ba82e9", "value": "T1173501AC3613B2DEC417D9367B545C68A6212C77130BC247E057329F9E1F596BE222F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638886750, "uuid": "72d6e27c-4334-487d-a0ac-4e97bfe51df3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638886750, "uuid": "889bf869-ff2f-45e7-a226-31d6501c5133", "value": "12288:PVVEwqDi0LNC3XilD70ry4FNX7GLISZ2CK6LW0LVLD5Zezc4oJQ07PumbYIvwI76:TzYLTofeISsCpqo9s/SPuydppqLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638886750, "uuid": "ffcdc106-b6dd-457f-a78d-8cb093c22178", "value": 1163264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638886750, "uuid": "c84249b0-a144-41e5-b87e-8396b0743c21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638886750, "uuid": "0f11ece2-b440-4321-98fb-97ea0b5e748e", "value": "Purchase Order No. P-8643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e9e6dc-574c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638874517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874517, "uuid": "230022ff-b737-4b6f-b4a3-09c40074bca9", "comment": "Malware payload (Heodo)", "value": "963386d3735d2b72edf95096fe029cd1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874517, "uuid": "05598065-b7ed-4cad-9291-d39ec3a5e283", "comment": "Malware payload (Heodo)", "value": "64eb756d8b6de3d451c275c6f77f857cc08bf498a9de39f069afa7673d3d0bcd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874517, "uuid": "a6a9da7f-9962-4f89-bc88-e311018b652b", "comment": "Malware payload (Heodo)", "value": "e3b084b077ffd61d5ebd195ff227a440a951132e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874517, "uuid": "f8d00135-9fd1-4ef6-acb0-d4ac13bd6e20", "comment": "Malware payload (Heodo)", "value": "2b0b9f3a901586ac04e1e7e33c3b28c96d2443d9651b42c5b672929cfd63a291ccd28320bb3b685535d8bc52d7f9eb57", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874517, "uuid": "2cd04e68-4ced-46c3-a021-13e60a5c83e7", "value": "T154F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874517, "uuid": "0150fb1b-78d0-489b-b78c-31dc9623ca1a", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874517, "uuid": "10202e3f-99d5-47fc-bda3-694df91bf10b", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/0:JapiKiBEmj4GbOX399Md9J/0Ty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638874517, "uuid": "2fc34810-cba0-47bc-851f-e089f42b3202", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638874517, "uuid": "f0698028-b3f3-4d41-b322-5f088fdb5fc4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874517, "uuid": "2142e74b-abc6-46ad-bb9d-8cc3a319d531", "value": "L25r5lq3jAYgm.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "540728ea-5733-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638863850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638863850, "uuid": "08f929d4-e96d-4f7a-a28a-7ad3d3858ef1", "comment": "Malware payload (Loki)", "value": "74a1b1e2cc24b483f6f1678e6da34682", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638863850, "uuid": "8cd154a8-32a2-4ee1-9bc4-74fcc00417ce", "comment": "Malware payload (Loki)", "value": "650906c59a17fc343cc1ecdee10567c37b48063d3a476f76da261befa0667da7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638863850, "uuid": "62941515-016d-45ee-8128-1562f608511a", "comment": "Malware payload (Loki)", "value": "99e21666eb2332ca94d2abf13646ef20bfc74f46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638863850, "uuid": "53ea32ec-69ed-4a5c-bc7f-7fd4c6caaf5d", "comment": "Malware payload (Loki)", "value": "aeb49b128a874dc6b7f6b9e0aaff5605ac7c2e60a356c5d3caa5eb71454ff1b50ed19873a45ba271e4b6b02c27bd2764", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638863850, "uuid": "a49b4cf1-8b82-4651-ae93-d5cc82a2fced", "value": "T1AF25F09D350371CFC85789B67BA86C78A5612C7B170BC257E057318F891F987FE222A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638863850, "uuid": "7e635e4a-ebd3-41f5-9734-4449edd245cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638863850, "uuid": "8b69e23b-708c-4ad4-9ab0-8e7467312e9d", "value": "24576:cdFfdl+IPjRwHxLiMu75k3XGNQjXtZpm8UPly85cuxWE9E3xcMDE:ciIrRcxLib75hQjXti8I/zkx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638863850, "uuid": "263765a9-62c5-482e-81d1-dd4004977167", "value": 987648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638863850, "uuid": "55862c24-9c97-44d8-8fd1-23df138a1f70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638863850, "uuid": "5c3dba02-0adc-4ac6-a4a7-764ab0f2c514", "value": "74a1b1e2cc24b483f6f1678e6da34682.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f04e85-578a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638901199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901199, "uuid": "21647e6c-58ad-406f-b0fd-366c09a023a7", "comment": "Malware payload (Mirai)", "value": "09d4b4817ac02e880c6145ceff815b86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901199, "uuid": "67ed7904-0f07-444b-b690-679fc87fd8c2", "comment": "Malware payload (Mirai)", "value": "665b4ee55a4baedab8a74bdbbf8310aa3207d5e86c13ba6677ea1812866e5e65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901199, "uuid": "42e17abe-c834-412d-8901-ad20f4dd8d73", "comment": "Malware payload (Mirai)", "value": "f903f848ece1029d8abdfdf55b57ff6df81dd633", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901199, "uuid": "aab7121b-ee9c-4415-9cc5-b66cd960f9e3", "comment": "Malware payload (Mirai)", "value": "78e197baf0ec7cf6560ea1ff2430283686fc4100ec4249906bc8593429177c5d0537689fb5726b90888460110358f709", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901199, "uuid": "25add255-d80b-434b-b617-29fb142a771f", "value": "T1F1337C67D82A4D98C5194278F4688D391B13F408A2973EF65E8EC762501BDBCF60E3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901199, "uuid": "3aeb61bb-dc78-4049-aa11-2f46cee53123", "value": "1536:uaok/dgBORYzVUsvbE07/EFDBiSurCei:uG1ftsvbE07/wDYSur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638901199, "uuid": "6fd274fc-e570-4b29-8342-6e11b34f375e", "value": 51968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638901199, "uuid": "38a467f0-71c8-4b3f-91a0-c79958e45ea1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901199, "uuid": "4740906f-9b12-4bf9-a54d-dca1eb689435", "value": "09d4b4817ac02e880c6145ceff815b86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e66171f4-5789-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638901032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901032, "uuid": "2969301e-e2a7-4d4f-ba03-7ad7e52c2576", "comment": "Malware payload (Loki)", "value": "cb03b4e0c1bb7036b99675191919984d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901032, "uuid": "2b39bb6e-8d22-4760-b098-7bab9799b321", "comment": "Malware payload (Loki)", "value": "69247f818f2e77020bc2f01597b63b96959e65b06c90989b993fd31c8795ee09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901032, "uuid": "c209b01d-0a46-4280-986f-71b7840b4166", "comment": "Malware payload (Loki)", "value": "f550e9acfd7a6007bfc7409963ae28da3723306c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901032, "uuid": "6e6e589b-4623-410f-9235-ba91fd0acb37", "comment": "Malware payload (Loki)", "value": "928258347e3a8138de9a68591229a86ca338436cf812e664f127d5352c636cb537bee81e8f49e2aed212e0eaa61e965d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901032, "uuid": "210bdb52-5e25-45cb-a6ec-8fd8a5eb34ff", "value": "T12E642353D7D15F3BD3AF0C3190F7BBB6F77A429C48434AA75FA82FA628212524E24191", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901032, "uuid": "0ce2808d-a3a4-4e69-ad7c-7964761e2782", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901032, "uuid": "185f9389-13c7-4e1b-be3b-cb00aaceac8b", "value": "6144:rGi+ZutcexTzjhzFcFmS8VzvQAJCWs+N4ZcHvNaIJ:CwtcexvjhqFmvZrNOgNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638901032, "uuid": "342f93b4-9fb7-4f33-96b9-70e6830bfdc6", "value": 308493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638901032, "uuid": "f7915a16-8355-4ac0-9a60-86b7eee5f700", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901032, "uuid": "98ccbe02-49a1-47d5-b830-35ddcefff11c", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b80c7b7e-57b8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638921141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921141, "uuid": "ccaa7967-086e-4768-8911-709734786e0a", "comment": "Malware payload (Mirai)", "value": "748b7a4d61f599ec3fd7f859521e77ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921141, "uuid": "36059805-f711-48c7-ba44-944fd65ea04e", "comment": "Malware payload (Mirai)", "value": "6950bfb9a022a00e008c10d857ff28fcc6e7bf3c337e48d03c948f901256eeea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921141, "uuid": "2eaef5a7-0798-4a98-bce2-3c0f379e7be1", "comment": "Malware payload (Mirai)", "value": "c6431d4a96931d6900ce12aa9bba29847a9bdfd5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921141, "uuid": "65e74793-66a3-421a-98e2-3d235c7fccb0", "comment": "Malware payload (Mirai)", "value": "78e01d9a49ea6d92e3cec80bf21b2aab9bdd851fe68c2c8b3171cd9ca18fb9bdf54f6896d2fe0695d33afd262eb935b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921141, "uuid": "b92d2268-4ef8-436e-96c5-9344e425e2d4", "value": "T1ADD2D026D02D8D67EEAAFE751C5BF2C77B609E1D77109DA10AF0EF026256D903A0C6D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921141, "uuid": "6962b931-5560-4b17-9403-524df638a86d", "value": "768:05GBlUiZZy1MAzd5CvQNNMG1EJ9lVKpsOk7tQo4uVcqgw09f:6G/UizLAzzN71EJMCH7t74u+qgw09f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638921141, "uuid": "6f30b2ab-e231-4c18-a30e-68c012ebec21", "value": 28828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638921141, "uuid": "522aa3f7-9023-4f51-acf8-3bb53fda117c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921141, "uuid": "33e44ecf-79f9-407b-9866-ad6bfe4c6593", "value": "748b7a4d61f599ec3fd7f859521e77ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7401c395-572a-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638860038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638860038, "uuid": "06a20f56-5cfc-4cc9-b24d-51e4dbf58ac2", "comment": "Malware payload (AgentTesla)", "value": "163f8986616ce464ec8d8e0f8a855ac9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638860038, "uuid": "522cb07e-cb4e-433f-a0fd-b9e007343a03", "comment": "Malware payload (AgentTesla)", "value": "6958f578d70326f004c2b6ec1950d7622f46051b6035973ec0c1304c58822a91", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638860038, "uuid": "ecf37274-973b-40be-ba99-dad242a654ea", "comment": "Malware payload (AgentTesla)", "value": "5726c78198bb2db81ffd097569d4f91087278e5f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638860038, "uuid": "15a001c2-43b8-46c6-bacd-a32a09138869", "comment": "Malware payload (AgentTesla)", "value": "907385fc83716d0fb6616114864aeadb0700ab3aae6a21867ba644a5bc81abaccfd79c56322fd64a0788a8c69ad493d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638860038, "uuid": "610d8632-97d7-4839-8038-8c5ac79cebc2", "value": "T1AF25230032C8CA67CB5E5BF1B891066183B8B48EA15AF39D5DC194F936F2FCAD76105B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638860038, "uuid": "e6220e0b-07d4-4e53-b746-e7699407a12d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638860038, "uuid": "d6f8f260-2a4f-4f33-a88c-02ef8e6df24f", "value": "24576:FH9meYVpwiAHPqaLsAiKQRRyNjQRjabrst10rY:FH9mekpwiAywsvnRRm+j+rst100", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638860038, "uuid": "1d5a0911-bc1e-4ce9-b30b-8d110c9ccb30", "value": 1053184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638860038, "uuid": "cdb026bf-430f-451c-b173-7b5fea8bb3eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638860038, "uuid": "cf27bd3e-a426-4b69-995c-33249f466225", "value": "Request For Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "673cd5bc-5799-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638907691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907691, "uuid": "c742618e-f44a-476f-93f3-8794912d0f58", "comment": "Malware payload", "value": "0d27d4a937d39f29767655a0fb3388cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907691, "uuid": "e760e25e-96d9-4b60-ac6b-cf78edec983c", "comment": "Malware payload", "value": "69f3a70a7903f71bcf0d6ed3daaea72c2c0e9c4243750f10ffbb870cb57b05d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907691, "uuid": "f3f12cb3-33c4-4f66-a2f5-9f2f124f96ca", "comment": "Malware payload", "value": "e951e11b7a8a529916723a58e96c8ce3954f8b42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907691, "uuid": "90f2d952-941d-4426-9238-8055c822847f", "comment": "Malware payload", "value": "8bb13d228a3f2ea1321e53f54a0b0e5ad51839751dcca48f4e18a5eba40949ca59b100dd9e0c077da9a6eeed0427a850", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907691, "uuid": "d287fdf3-75ae-4570-9a24-6d9b0ee2deb6", "value": "T1B2648E1067E0D434F5B716F84ABAA379A93F7AE15B2490CF12D516EE5634AE0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907691, "uuid": "f06dd983-0279-4a96-9987-58605a4a0eca", "value": "b5d39f822cf46cb1cac0e9a27db40014", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907691, "uuid": "563f5057-621a-4db0-8302-40f23f0ba703", "value": "6144:bpZQvHt8r5Gq6/l4NUYUECziAPBGKQWvDE/ThI:bpZQvHGr8V/+NUYdCziAPQKQW4/Th", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638907691, "uuid": "4d9774de-6f91-4f5f-a7f5-29f85e9867d7", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638907691, "uuid": "fdba3d61-340c-4298-80c4-4ca2ef7b2ee1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907691, "uuid": "de8d7d0a-4f73-40e8-b3dd-44fc0d412b7e", "value": "0d27d4a937d39f29767655a0fb3388cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42462651-574c-11ec-96a4-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1638874558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874558, "uuid": "a58c4a58-e12d-4a46-a492-b34d1468c15d", "comment": "Malware payload (AsyncRAT)", "value": "9b12e276e7b3a7b48fb9aae0d64b6c37", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874558, "uuid": "1010bb30-ec55-4e11-b26d-aea3a3f5f9ac", "comment": "Malware payload (AsyncRAT)", "value": "6a3177ceb6bcb0f5c688e9b8458fe77647cbd369d1d9d8749dcb92653504783a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874558, "uuid": "87202082-a3ef-4354-ae3a-473bedc654f9", "comment": "Malware payload (AsyncRAT)", "value": "8878b19c70f896c1ef0893131c933841da3c8b5c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874558, "uuid": "fd2b859a-e88b-49dc-9acf-b43e17d5033c", "comment": "Malware payload (AsyncRAT)", "value": "451ed2c2411edc26093c66737daefb43d61bb8499a6dbfc2d8bef17509c2fcae59059aa1efdc591d7b92dd09fa94cfc5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874558, "uuid": "03018f15-ab88-4d68-b8c5-6048e3e6dcfe", "value": "T13884F11C77C1CDB2EC0DA1B088A12D756B3B0E13D640655963AEF5C6877AC9BDF0A98C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874558, "uuid": "1544709d-3544-4190-b0a1-db7da262f246", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874558, "uuid": "bbc6ec62-c9e3-401d-b422-b4ef9f2c1598", "value": "3072:jjnTw+GAfBXdd5Is6QTIWV4EULtUzxbCi8HqpGjrX1VnevxL//8KTAVQvetrYV3o:jYwqHMbOJbvEeMxL/mKZVcGR19ONx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638874558, "uuid": "47ef5ffb-c8ea-4fb3-b588-6e269af89257", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638874558, "uuid": "72dcaf31-50d7-44d9-b47f-8d10f32cddf7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874558, "uuid": "c3e6d02d-75c9-40cb-9c03-80635883e37a", "value": "shipment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78501ce9-5775-11ec-96a4-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1638892258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892258, "uuid": "d4ea5b84-de7e-4296-b6e7-eea314924e34", "comment": "Malware payload (Amadey)", "value": "61667aba094e35950f45d5d627952663", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892258, "uuid": "09036a50-ff70-4ad7-94eb-e93ea7071914", "comment": "Malware payload (Amadey)", "value": "6a48349ee2b3ea08a4a5a51aaaa9eef19ce3e5c63289d1d4b50435112e049248", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892258, "uuid": "82edb228-efe8-4aec-b1e4-bce743d1f989", "comment": "Malware payload (Amadey)", "value": "55b3df527f7fda353f8ff0a30ff9ae9fd97d7ff3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892258, "uuid": "f05ee58e-90ba-4ea7-8125-a58dd105c0d2", "comment": "Malware payload (Amadey)", "value": "462bb614b996806aaccbc4690371b31d6090d0dfafc09676c04466f11d5f747dc48812431d33f87217ee928539197fb2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892258, "uuid": "7cca8f4b-95ce-4c86-9166-16434c8446b0", "value": "T179648D1067A0C434F5B716F85AB6A279B93F7AF16B3490CF12D456EA5634AE0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892258, "uuid": "0ae5d982-bbaf-479f-814e-07421511de3d", "value": "b5d39f822cf46cb1cac0e9a27db40014", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892258, "uuid": "ab2240b5-a566-4ef4-b8f2-532e48bd7e55", "value": "6144:fT6saWGKyITFf1C0dOBgtpheUDUrCi2tkfntEWf9E0QjPp:fTTBFc0dOGveUDiCi2tkPtEWy0Qj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638892258, "uuid": "0ed9bd29-3887-446d-b938-8ab3f26e445e", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638892258, "uuid": "31b047ce-a74e-4379-a486-71c033da0b16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892258, "uuid": "de6f35a7-8024-4295-8e82-7bd8e60f23dc", "value": "61667aba094e35950f45d5d627952663.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f26656-5738-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1638866217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866217, "uuid": "1b7383d3-bb42-4c21-8e52-9bd4dc543414", "comment": "Malware payload (SnakeKeylogger)", "value": "d1702414a52c34e99dabde54e533d8f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866217, "uuid": "8ffd70e7-8c1f-4891-9382-c9afca2d59d9", "comment": "Malware payload (SnakeKeylogger)", "value": "6b3363675164244c512f5f27f200f77238449db1cf0b03fcbec0b7bf5ceeb1c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866217, "uuid": "a3ee588f-a658-4da6-93c7-bf0208e5d020", "comment": "Malware payload (SnakeKeylogger)", "value": "1430af931505c5f0a59637d21871b95524635891", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866217, "uuid": "3bb10064-6f26-449e-987a-df311ac6f966", "comment": "Malware payload (SnakeKeylogger)", "value": "f12e6324a49bf94fa3269b862ae7656f77f6ce23e89115e90dde6a1fe7cbcfe4948ff155ad74efa2e1a61eeddab5a3d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866217, "uuid": "2b02fe34-9dec-47a7-8059-786bc99335f5", "value": "T153D3055D3BF88800E5FE8A7315719122C7B9F852196ACD1C1BC1F56A2A7DA40CD1AFE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866217, "uuid": "8ac77af7-ed88-4f8f-aea8-a3c4a816ecc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866217, "uuid": "371738a3-4973-462f-a4dd-e4d23eef69a3", "value": "3072:9Jm2iMOwKxusq242EAwbJ0VbbC8eVJr0bwBtYnbY:4cNT2EBobRmqYmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638866217, "uuid": "8255bd4a-ca54-40df-925c-0a2f54be7f83", "value": 130048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638866217, "uuid": "1cd797a4-e6f0-4435-9594-929a36c998ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866217, "uuid": "098b83d7-79aa-4da0-9322-e5515167a55c", "value": "Q-700004637 1004913.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe52c29-5714-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1638850582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638850582, "uuid": "bcac9628-4b95-4a3b-8562-ab9709df4f6c", "comment": "Malware payload (DCRat)", "value": "aa7a305ac8d95de6dbc151c093cf27c0", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638850582, "uuid": "c00c4523-536a-419b-9a33-53f01d91a167", "comment": "Malware payload (DCRat)", "value": "6b5f74f777082d1fda76d3ae73470698d6351fed5d8380dd0d5dc32d32fe76c0", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638850582, "uuid": "d80222ad-ec99-49ef-843d-f682a5384118", "comment": "Malware payload (DCRat)", "value": "2310329f114a4069669b671867b438d4982a5ade", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638850582, "uuid": "de229c0f-a934-474b-9a77-affcecf6c6de", "comment": "Malware payload (DCRat)", "value": "28b96437da644b53b573e47f90f8a6de7ae42371cd63d1e4c96051d4c65f0d5b20618c7cd4203922bb48b687d6d0185b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638850582, "uuid": "d455ac6d-ee41-4346-8936-2222110403d7", "value": "T1DFB5CF113E84CA02E12A563BE9EF805447BCFD416E62D71A7EAF339D25513A71E0E1CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638850582, "uuid": "949596bc-8643-4685-a6cf-85981240dfb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638850582, "uuid": "a1bef3f1-893d-43b8-aa9d-ed15bf11eb5e", "value": "24576:tg/TM3unSV8JHYj0M14oMKhqN8+r/tse9WPJXelRWjq+jPx8FT2t6nTtHtO3g4Jc:mQenScjKkr/y+qXeliq+iT2t60g7Er3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638850582, "uuid": "a99f8305-21b8-4b82-b476-2737f726b3ee", "value": 2341376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638850582, "uuid": "eaadd600-80a5-4e87-8080-787e50650f18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638850582, "uuid": "ff86eb6f-9e34-471d-8430-cb1cf6572ff0", "value": "aa7a305ac8d95de6dbc151c093cf27c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c671a56-5709-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638845718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638845718, "uuid": "8b2615a6-9001-4d26-afef-c2dc9c835d20", "comment": "Malware payload (AgentTesla)", "value": "6d1b1ba571be9de5ff5774f3643bd22a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638845718, "uuid": "ae33c1bb-3787-4cb4-92fe-583cd024f5e9", "comment": "Malware payload (AgentTesla)", "value": "6c12f7fc43b6c7862b75e6a58d522ceb6ef09b65c62dfb67c52dc38957ede4ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638845718, "uuid": "c08d2e2c-0812-4d69-a22f-c9c4337f2295", "comment": "Malware payload (AgentTesla)", "value": "ab5b5f0c57d75a7be6d1170beb9f1a463d508ef9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638845718, "uuid": "78b6c1f3-efd0-4554-8440-5178f9467127", "comment": "Malware payload (AgentTesla)", "value": "df80e3f768b5e9790ae4e56c9f12bd6cb186d4cee62975947061df670eb2c40ce56994eb77335a65aad468f5e2209368", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638845718, "uuid": "444b74d0-c8ca-483f-b533-d0bfbd5abe32", "value": "T1BBE4AE4866C0C6B4F83AD7B41C7168910365BEF4E880E7BEFD8872F65BB32950911E72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638845718, "uuid": "7e53ec45-70dc-40ff-a6e2-b3d71912c74b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638845718, "uuid": "9f51dc18-d5a6-434b-8894-d8f352773181", "value": "12288:RM0a2iNkf110DtIo3wEx6JtlltLc6Nn9e8jplCV3Li09zDT:RM0a1KT05Iqjx6JtFtjemu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638845718, "uuid": "6129b865-59ea-4b37-ae6b-17abd4fe4aaf", "value": 711680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638845718, "uuid": "5f4bfd56-1d1d-4e2a-bc52-c090db0c2ec1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638845718, "uuid": "f299e135-9338-482a-ac36-54d40e17e896", "value": "DN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aad8d28-573b-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638867270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867270, "uuid": "a570cf4b-084f-4d99-9abc-a10d2621f95e", "comment": "Malware payload (AgentTesla)", "value": "eb1fec1c32a6574a8b64e28b0ba271e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867270, "uuid": "1fa66b55-f75f-4886-9306-3935f5e09ef5", "comment": "Malware payload (AgentTesla)", "value": "6cffc9dc8569478a7020ef206110a4ed100e26a535432830790324be25de5e4c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867270, "uuid": "ef54840f-45dc-4902-8ae6-9e55c4a37cb5", "comment": "Malware payload (AgentTesla)", "value": "ac6776369c9e07efbba85860330362e2474723fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867270, "uuid": "c96a3c22-e2b4-4ce3-b4f7-3e77dbe60ef8", "comment": "Malware payload (AgentTesla)", "value": "6f61e4cb43505c9888bbf0a083a7bcb136a13a979497c134207a375b8ee6ed0676c02aaf9977e05c7a514b76ce42a65e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867270, "uuid": "f56d8484-bc47-48f9-92d5-8b80e4635253", "value": "T111F433829C09A0D7D6EBE46418D84E1AD95F7B20B35E872FB7914A31360ECC67749B32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867270, "uuid": "4371d268-0ae0-4ca8-903e-71e3641bca1a", "value": "12288:a9Gwo+icsLxP4E7Wztkw1+sT0vaeQrk3cTE/nDya8GleftL0zYrYstfzP:akwo+i/LqwStkh0k3ceB8GleVAMrJfD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638867270, "uuid": "e4b1875d-802e-431c-9d90-7bad2bf3db75", "value": 746202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638867270, "uuid": "46d33a67-51c0-4b7c-b195-d626135c0747", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867270, "uuid": "5d038030-ada0-486c-90d0-ebbc8d68719b", "value": "new order 00041221 (2).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acfbf3e1-5738-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638866147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866147, "uuid": "6dc856b3-ee72-4a54-9b7b-f0ad0ca52278", "comment": "Malware payload", "value": "e8f195ac51c7a92a323b1db5805efc95", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866147, "uuid": "ae7faded-6dc8-427b-beb0-bcfcc4e03b29", "comment": "Malware payload", "value": "6d96f149b4c35c10c0117b00b864d25321b8d9f45201387cd31d3b173f625a92", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866147, "uuid": "5324cd72-5db4-4811-a35a-7ed51c3d3951", "comment": "Malware payload", "value": "7d0d53a7d3dc2d11fa3a00df90389852a7848880", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866147, "uuid": "c1883a67-cc74-4f22-9305-612170e16b7b", "comment": "Malware payload", "value": "9f26d84d58bf0f8616228f1fb627dba8be3a69930de21d9a3fc1394e252b52cd4e583420e4dc27625412d45ced13d409", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866147, "uuid": "35fd5b37-0a36-4fcf-a373-e5bc8727e706", "value": "T115347B2276C1C036D2A334B0825AA67566EDAB301BF696CB6BC41D395F741D2973CB0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866147, "uuid": "94ae3fc4-d339-4f8c-82f5-ad83e5f14374", "value": "6144:8JuLf/WAlRkVQqLyqoGN4BmbvC4zUQtIlHN3nkp:HVqLOGNVDzZtIlHN3nkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638866147, "uuid": "a65833f3-1253-4f8d-85c8-ed1145a25383", "value": 245334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638866147, "uuid": "9013f97b-7ab9-49f7-bdc6-cbc9c833002c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866147, "uuid": "0a0d7829-788f-4c62-8592-438c4fb83c75", "value": "emotet_exe_e5_6d96f149b4c35c10c0117b00b864d25321b8d9f45201387cd31d3b173f625a92_2021-12-07__083542.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d7688a-5769-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638887187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887187, "uuid": "9b4242bd-1ed5-485c-b59b-b60657e1a7dd", "comment": "Malware payload (Mirai)", "value": "8cab63022a8c2bd3821eb08ced65c70b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887187, "uuid": "8c797bce-540a-47bf-8469-0484ac5e5559", "comment": "Malware payload (Mirai)", "value": "6db196d01cc2bb831928efcf725f966c12a694888af0f306c3f5f29e595a10de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887187, "uuid": "af5c5cce-290e-4942-867a-17b1e9108dff", "comment": "Malware payload (Mirai)", "value": "739a840bc883e1c039c9de7f5289b0e3293ba119", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887187, "uuid": "f296b78c-58d8-4c34-9619-6f4c34f71f7b", "comment": "Malware payload (Mirai)", "value": "148c12299509981060d0ccfe0194dba60c28464bf46fcec1ea9eeea2daa7630352d7301ecdb5286ef5cbb581ea197cf5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887187, "uuid": "9f8f8149-7cdb-4519-89de-d111fd13c23b", "value": "T164530201F7BAA033D1627D70F3DB49C522A10475E3F8A6A66223470C5DD36465ACED8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887187, "uuid": "f766b57d-045a-49f1-9535-e10c5048b51c", "value": "1536:5czz0oXzUcve93xGdU1wH/LKYq6yz9LgV+C3r+y:WkoX4ce99N9LULH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638887187, "uuid": "8dc6a76c-a3a0-44ed-afbe-438e06f6a048", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638887187, "uuid": "cc094cfd-8628-46af-aa8d-8db31c9ed46d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887187, "uuid": "f2b92e8a-d840-410e-9471-c928ab7e306a", "value": "8cab63022a8c2bd3821eb08ced65c70b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136e07c3-5711-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638849139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638849139, "uuid": "30a50394-30be-458d-8437-c9509d25868b", "comment": "Malware payload (Formbook)", "value": "d1030b00c7c619898773045b5655c4de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638849139, "uuid": "53080086-459d-4f06-b3f6-ac5c0daf3f3b", "comment": "Malware payload (Formbook)", "value": "719d886691ce91e7cbf30951199fb337e7ed2d1bae4c381a57da2d3802594be2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638849139, "uuid": "be07c473-7b9d-4703-b269-1dba8dc83f8b", "comment": "Malware payload (Formbook)", "value": "6a51fd140e61ccf5952111ccaba2b8cf72709257", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638849139, "uuid": "b1eab0d1-0e2f-410d-93cc-d2cde960e36c", "comment": "Malware payload (Formbook)", "value": "c1f648bdf050372c32bb0eaef50ca415d88435e25d1cd2c2fcb602983122ea841b8e9a22f6381c77c67124f964b42e1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638849139, "uuid": "20fcc3c7-b568-4ab6-81ab-f4d89f48b6e5", "value": "T18325236123A0C72FD6BE5BB0D4A089947B72F54A1642F3262DD0A0FC39E77C9D9066C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638849139, "uuid": "84f7e343-9d19-408d-9d1f-9e6a17e7ca8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638849139, "uuid": "10009209-f70a-4c2f-96e2-1acfeb0e4319", "value": "24576:2G/e4C2bvS0RrejtS9zRm+wvhahBFQj7qM0G:V/e4C2bvPRrejKzR/YEBAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638849139, "uuid": "2de3d255-5a2a-484b-abbd-984d93446f09", "value": 1042432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638849139, "uuid": "c13d00d4-e8c7-40b2-a8bf-e5215b213e2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638849139, "uuid": "7355eaaa-e0b6-47e1-9ef2-889e02586aef", "value": "#QUO_SMLS_H1130 Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db36d40-57a3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638912024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912024, "uuid": "0bb59ccd-6fce-4524-8437-7c6976b226ab", "comment": "Malware payload", "value": "06c33aab4ecea297268ca4a0cbe7f584", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912024, "uuid": "22a96c3a-58ea-49e4-9459-c1f84f2d6c20", "comment": "Malware payload", "value": "726a09eb16bf03392665f92c016045be1bff7518d1dd941f8dd6f9621a8fc608", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912024, "uuid": "70965f15-34e7-463d-a727-5b408c74fecb", "comment": "Malware payload", "value": "0d4aec9bb412bf697cf4d1c41b21b6c4ff3d5d34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912024, "uuid": "1c7674dc-946c-4e85-9af1-b2b9a5d14b2e", "comment": "Malware payload", "value": "4e0232836c5c205738a8760544d4f0c923309287090774173737a3972c33e2fd2cf1c9cb0ce07b3b6a083555fff4e47d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912024, "uuid": "dea04fc1-765b-4d26-a589-a2e94f0180f0", "value": "T16435126C36A3A6CEC5A243753B5A9068827A7C37146BC25DE85A328F54377863E33353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912024, "uuid": "a513b771-32a8-4725-a992-13d74af22855", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912024, "uuid": "ee052b72-2e87-4185-83ef-84409e997e7c", "value": "24576:xZway20NECwSveo4POjJq50AuEerKhUXvWaqWD1fnkQ0:zwNNFw1hOUu/KhU+6DdkQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638912024, "uuid": "eb38d62a-71cc-4e11-8c16-4952b9aeed5e", "value": 1065472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638912024, "uuid": "92c617eb-7e37-4678-b8ce-ee6fbfbd0c4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912024, "uuid": "30ece70b-61e7-42ad-aadb-a9285bbb9448", "value": "ORD0210467.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8860d0-5763-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638884479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884479, "uuid": "0699ce39-93db-43bc-944f-a75cd1258a22", "comment": "Malware payload (Loki)", "value": "0c47a0b35e4e809bb002bb9a41b7a6a2", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884479, "uuid": "26aa38e6-8101-4421-83d3-51f6532313fd", "comment": "Malware payload (Loki)", "value": "72d66b77bf74040c75ccbe723b24ea56d0a6ac0cef16bcd68a68a054c04b67b9", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884479, "uuid": "033aaff6-bdb9-4796-a013-0ca537a5a67f", "comment": "Malware payload (Loki)", "value": "5bd76ab1570062d5a78c2dcd70025b18f48be251", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884479, "uuid": "e6295f21-8196-4b3e-b279-148420c0c1dd", "comment": "Malware payload (Loki)", "value": "1da0a081be2d130caffcde107a91b463015761313a1b883f84fca95f764b7633167864fa169f6628234f3fb35eca4ca7", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884479, "uuid": "bb0f0244-72be-473d-be00-a89dd94b6ad1", "value": "T1E092477EF65B0E48AE86D678065A7BA5064DF02D72C440E237BCDB38794C8578B32D38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884479, "uuid": "f26e7ad1-2a06-4f6b-b49e-3f88173bd7e1", "value": "384:RIxq3ZpGLIWjzi9+AIgVCSABp1O79IiVVLbBWqz9V5FtOIua:D33GLTjOvIgASABLOPFtDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638884479, "uuid": "3bc0c543-2780-4283-abf7-41705d8608aa", "value": 20979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638884479, "uuid": "44c88be8-4575-4896-878a-fe9eae46409a", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884479, "uuid": "3111f301-ae7f-45bf-a991-f200d7381503", "value": "0c47a0b35e4e809bb002bb9a41b7a6a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf09aa67-575c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638881639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881639, "uuid": "68c69c62-57b3-4f23-a6db-77fda499fc13", "comment": "Malware payload (Formbook)", "value": "d4c17fcd13114a49f294770bc4f496ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881639, "uuid": "8b687990-9970-4ccd-8de3-6577507bc5e9", "comment": "Malware payload (Formbook)", "value": "72fa6db7a26f706a401ec08755e29dd21034f7018e784be28b42df9001c2c9c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881639, "uuid": "61b42591-c79a-4e3a-a941-02b9011bbca8", "comment": "Malware payload (Formbook)", "value": "b30ec81da45f27f6fe16cde324e4580ee434cb53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881639, "uuid": "3e12fd9e-f5cd-490e-94e7-cf9c6b8232af", "comment": "Malware payload (Formbook)", "value": "fecb32b9e51c4fe9833c01d1eca8602308e3ecefbd8001b5e67b30813ef4b5fb47e9f722d8f02f6a8f5c63e651568e9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881639, "uuid": "e6fc6d28-9eb1-4450-a780-55c68e6fca25", "value": "T1A1C40419B5AAB3AFC9ACB575D0D1F0328737B60B4DB4DE71B090D98609F48799B2408F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881639, "uuid": "3bdb3ea1-7002-46ff-b7c2-809f96493fab", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881639, "uuid": "9f2e23b2-d49e-40f5-8a9f-b1b75b16462c", "value": "12288:PFUYRRRRQRRTFA+9aCpWmyTx4NgK7VnIzHK:PFrRRRRQRRTFAoMmyTxsgK7izHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881639, "uuid": "b4b74b1a-2b03-4922-a9fa-a7317de6dfc9", "value": 548487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881639, "uuid": "2c97f912-6b1c-434f-8090-0303849b28d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881639, "uuid": "4eb0adfe-2fdc-4eba-98c1-77017b88f893", "value": "d4c17fcd13114a49f294770bc4f496ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "babba8a4-57a5-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638912985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912985, "uuid": "4fb3a1be-d401-4734-9dd7-1d9b2ec0c1c9", "comment": "Malware payload", "value": "c2df5601485a33aa2feb1cb3b00e1bac", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912985, "uuid": "a6c60fca-261d-4788-989d-2081dd4d6fa3", "comment": "Malware payload", "value": "731c0da8d74adbb557a0abd4ec2aa6c61e09d429560d76549881f08e564b27cd", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912985, "uuid": "a567229b-2ddc-47ef-b813-9b758c68a137", "comment": "Malware payload", "value": "3d1d4445e5daa4e88adca360e45da9277c60eb4d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912985, "uuid": "54979d6a-0b45-4e92-aec5-2a8e477b7090", "comment": "Malware payload", "value": "3bf167b6b74e67a82e7ce877f68527e541a946a795058dda84fae77c2d57c50521a53c669763df22174f9a21fe224cf1", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912985, "uuid": "6383c7aa-59d8-4651-a532-d8dd916c2ed7", "value": "T1C3B5332BCA0621E2F2ADC97445C260C57D5FAE278B4057EAF81F3844273BE902C5DA67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912985, "uuid": "8241a379-ca32-470a-814d-06969a2658c5", "value": "49152:7mqf+e8Gt15R82zo8pHuxwmzxXHb2Vee82QTJf5GPQSQPza46f9JA9ETwQTZt:iqfwGt15R828EH3+XHb2ce82QVQQSQPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638912985, "uuid": "c78d1589-87c1-4b77-918a-c52ed15afec0", "value": 2317643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638912985, "uuid": "9b20629e-c38f-421a-90c9-8c07175140e6", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912985, "uuid": "40404809-e0f8-44bc-b2f2-748930e71276", "value": "Aleyna_Tilki_Ifsa.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f66ab1e-575b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638881049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881049, "uuid": "f7ee5872-1209-449e-bf9a-cd4e2c0fe9b8", "comment": "Malware payload (Formbook)", "value": "046b1bc419c9849276e2c147de77076a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881049, "uuid": "62d43e69-a911-43ad-beea-7b362a39acd3", "comment": "Malware payload (Formbook)", "value": "734bf6dc37410e78255fb46135d5914666b39f17124efcfbc20fb005c54c75ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881049, "uuid": "f4dbfd77-1ccf-4712-9c65-062b98540c85", "comment": "Malware payload (Formbook)", "value": "7be76e5ecde0cbf8c3d3a5374e789cf8123b1172", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881049, "uuid": "bb545cf0-3f17-49a5-b4b8-c94bdcaa8ad0", "comment": "Malware payload (Formbook)", "value": "0713f509d9417b5cec4e2077cdf2c713683c1a4dcd22e511088cef75d8699967b3dc0df2ae12affbc487e64d64d9f537", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881049, "uuid": "6248932c-6843-4fba-b86d-4db531c1b8f1", "value": "T12A252302669ECB29DCE0677BF86622720BF1555F9A31E30DEEC13CD75923781C2A1993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881049, "uuid": "0d44426b-ec7b-443d-863d-ce3b1a23f604", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881049, "uuid": "95ecc282-1d56-40f6-8bef-dff86e2d8eb3", "value": "24576:U8so9yvTohj5dOsY7ev6RZHxHguErsVgb1pW4HWktF:UQK0hj5dODjnAutGb1pW42KF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881049, "uuid": "3b61aa33-0a8e-4da3-acd3-4744b48d6397", "value": 1026048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881049, "uuid": "21a2672a-1413-413c-9bab-0fc80e142dc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881049, "uuid": "f725070f-1400-4cfd-aaf7-f90340f23041", "value": "046b1bc419c9849276e2c147de77076a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5054d0a7-5763-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638884460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884460, "uuid": "e0202171-1c4c-4d31-ba25-39160075ab2f", "comment": "Malware payload (Loki)", "value": "c0330f8c001b5d8b2e36cc9dc36c1b5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884460, "uuid": "8ba2525c-1ebd-4a80-957d-7a6285fbca04", "comment": "Malware payload (Loki)", "value": "738bde0957d2c108d8c3c965e09a5f31ef9a35014d7b3c2756a7f92f88a6553b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884460, "uuid": "6a300041-8fb7-436d-8ac6-a0b23616e880", "comment": "Malware payload (Loki)", "value": "120f48e7b9c45e6a06d001e7374437aa6a1967ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884460, "uuid": "4a6e9274-c57b-4b12-9053-db78c4bae7c1", "comment": "Malware payload (Loki)", "value": "f4c8fd0d3681b2ffe8c892f3684965d92cb1a7e881068783379c5ce0ee5d853064838ef296c49db56c745ea8f8d0f6a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884460, "uuid": "54262be7-89ff-4ed1-bddb-67e307ecdb26", "value": "T12074DF4656E8C52EC42F63B4E59010F113B25D1AFAB2E3DF4E80FCA33A76B41996570B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884460, "uuid": "7d509c5c-84a2-42c5-8968-369a3c8916ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884460, "uuid": "c369473e-d721-496c-97ca-e64ccb7e4555", "value": "6144:gPBDdiUtk2hae6BZ/3ucN7Z92BJwAvk7vRkYA1m48YXSXpWL:ydiURP6XeclcBkz6c86U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638884460, "uuid": "2bb1c36d-41df-4bd1-ad7a-bb53e137b526", "value": 339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638884460, "uuid": "fadc3668-cbf8-4b91-899e-03cc987d7e16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884460, "uuid": "438706e5-b195-46d5-8824-00bc6ac58211", "value": "c0330f8c001b5d8b2e36cc9dc36c1b5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c025fd-5756-11ec-96a4-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1638878996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878996, "uuid": "976a1fc6-2c6c-413e-86dc-e0cd9ee2da51", "comment": "Malware payload (QuasarRAT)", "value": "57cf07a884fdc1617c1a3bfb003d839d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878996, "uuid": "3fbafb7a-6c11-42e9-9be3-a16b79af7553", "comment": "Malware payload (QuasarRAT)", "value": "74019e051a34949f1bd9960e1026aaa3c3175f5ba0855254666e231b5e075e22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878996, "uuid": "9805b300-5925-4487-8daa-03b7cb36f141", "comment": "Malware payload (QuasarRAT)", "value": "beb2edaed2c1ee4868d5027077a7c9e6898f958e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878996, "uuid": "b97a6a23-d65b-4c9b-a9c7-31a245f1eed9", "comment": "Malware payload (QuasarRAT)", "value": "2e93d0f92999c95553e3806939cd2efca572cd601fafc0638c0b03901e6dc7811a933b2027687dc4e1d0f1616a3f5432", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638878996, "uuid": "8f61ac6f-efc6-4401-ad71-f3d3621bc851", "value": "T104747C137398EA3FD1FD173AE43246050BB5E407B726E39B5A5895B92C133968D823B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638878996, "uuid": "417c798b-deb5-493d-9ff1-8e743f0cf332", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638878996, "uuid": "c8320451-1bfe-46bd-90b6-3e09f86a701d", "value": "6144:oBNHXf500M+QDnQhSVLTwTagv6Lrs9hbMiaM1/SX8sW0fQQm:Yd50XQQVS1R1/SX8Qffm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638878996, "uuid": "37affad5-de75-4d4b-b129-6d9f2eacbb7d", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638878996, "uuid": "bf2ea50b-8ab5-48c8-b796-1923148ef609", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638878996, "uuid": "bd1a3e2d-c8c0-4854-a57c-87814075264e", "value": "57cf07a884fdc1617c1a3bfb003d839d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51766d41-574f-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638875872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638875872, "uuid": "8cf9e9b2-f622-4f57-b87a-1af8e2dc3b8a", "comment": "Malware payload (AgentTesla)", "value": "4eb74edeaf8f5c6486d1c44d5790a86e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638875872, "uuid": "d333be7f-a585-4777-9376-25f4a86034a7", "comment": "Malware payload (AgentTesla)", "value": "74166c25bf897e34d2472be8b03709962c71e21a6b2257a49fa247b0a8d67884", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638875872, "uuid": "77a9670b-8f73-4463-b05c-8b8daa8585c8", "comment": "Malware payload (AgentTesla)", "value": "8ab5fbd9dbeeb6ac2b59841048ad2a861fa9472e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638875872, "uuid": "ae56dd8e-ef79-4f8e-a220-b4be10f11748", "comment": "Malware payload (AgentTesla)", "value": "cba458f4289820b37f0dc72cb5b78cd8486a99b8c54aaa3400ee72ae1b96292eb3a7c2002c187f9294c6aa0c9e776122", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638875872, "uuid": "1f274074-258f-408b-a4f2-4f0eebaa221f", "value": "T1363512AC796367CDE68247B13B6A8034522A6D7A2157D1A8D05B319F1C3371A3D33BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638875872, "uuid": "494e1894-f7d1-42c3-b033-591ece065a49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638875872, "uuid": "23634b4c-c855-4fd7-b243-0671bf036500", "value": "24576:AGrCiUmrqt+D3O4ntsk0AKJowPfnRa3OCYrSqluUgQaMKJ:AawmjD3Ot1J7fJQgzgd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638875872, "uuid": "749531c4-cf7b-493a-8372-a941766745ad", "value": 1103872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638875872, "uuid": "3673afe2-fb2b-42b3-b891-147a26135ce8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638875872, "uuid": "543611bd-3430-4436-b4bd-10b885027f45", "value": "TT advise.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61ec5aa-5776-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638892791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892791, "uuid": "407e4dd0-14e5-4b69-928e-640879ad7ad4", "comment": "Malware payload (AgentTesla)", "value": "d35d44b54af706e587fc1a5a8289d9b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892791, "uuid": "f8b2b26c-ab46-4c67-8256-3dba82a29c07", "comment": "Malware payload (AgentTesla)", "value": "743061395a4613319b00d41abe559c939762c5631e9864360e9d854c5dc512b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892791, "uuid": "b172d0c6-cd1b-4fe2-857e-29e7515d399b", "comment": "Malware payload (AgentTesla)", "value": "6382ca4f79224ab58d71c45f10c7d2b9a800306a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892791, "uuid": "6edff081-83c5-47cf-9e21-c37a99ab7ed2", "comment": "Malware payload (AgentTesla)", "value": "85942b72f94e1784b8153e73d761cb6d45f1fcf0eec8f155d2d84125dbe1daa5ff12833d6f129f47dbd54d9aeaab64ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892791, "uuid": "d3c97208-7b34-4338-b583-37ace009f31d", "value": "T19AF4ADAC3250B9DFC813CD76CAA82C60EA6174BB431BD603905716ED9A0DA9BDF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892791, "uuid": "817c4f2f-e60d-44da-a25c-e11eb1fa8413", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892791, "uuid": "80d8ccf3-a8bb-407e-b8cb-33e86292306d", "value": "12288:hCmcYhQ/TiHfEgbCZ0GsuzCXxxt1i65LTQv4cdJYRtdbsAvszD+aRLmsQMDY+oWd:MtY+uHffeDAHtQr4cduR7IAvbal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638892791, "uuid": "fc1e0fac-050e-4a5a-a6e8-94dfd282b1d9", "value": 761344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638892791, "uuid": "067a3544-25d6-41f2-a156-1469ef5d8135", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892791, "uuid": "e7dc27cc-f460-468c-a6dd-495c65c827f3", "value": "Pago completo.pdf____________________________________________________________________________.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4eef12f-5722-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638856765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856765, "uuid": "a162915b-530e-419e-95c7-5c1ba0495c50", "comment": "Malware payload (Heodo)", "value": "b95e69d8a09ffa51dd0090a0d747c634", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856765, "uuid": "56eed100-1558-49ec-8fd6-4dad42509947", "comment": "Malware payload (Heodo)", "value": "7462433738d6648a77902dbae7209f4e309dbd7fd65565cb0875c2bc9396b924", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856765, "uuid": "65d97738-b72d-434f-ab3c-0f9ceafb48ec", "comment": "Malware payload (Heodo)", "value": "065e361e6748078f9f7c1c63083fe2206e5d41d6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856765, "uuid": "7f782be9-6801-4a96-bbd1-2f92afa2083d", "comment": "Malware payload (Heodo)", "value": "12f06bacaaf8e664a93120efd0f3b160df3fec753bd05b86b12bf452bbeb107ce5306c375bd431faf87bb4dbe11c629f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856765, "uuid": "5454ddec-d070-492d-bde0-0c289c40c4bd", "value": "T149C44A40E301B03AEAE700FBCAFB49AD9568A72463C669CF56D86DE5D7284D03D3251F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856765, "uuid": "a25deba1-6884-488c-9a04-a28a002e06ba", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7gL:JapiKiBEmj4GbOX399ML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638856765, "uuid": "7aafe939-d71d-4612-93ab-9dc34ae1477b", "value": 555505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638856765, "uuid": "d80c34f3-0000-4cf2-9158-f0ed755eeff9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856765, "uuid": "7c6fee69-17b5-472a-b421-b9ab20674f46", "value": "emotet_exe_e5_7462433738d6648a77902dbae7209f4e309dbd7fd65565cb0875c2bc9396b924_2021-12-07__055920.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f12e1863-5782-11ec-96a4-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1638898044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638898044, "uuid": "ff309ff7-7fae-46c4-b396-b60b3f830383", "comment": "Malware payload (njrat)", "value": "a2105798edb6b4164a60c200ad1c4e3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638898044, "uuid": "0e936fdd-780d-4342-a0f1-6ced83f716f4", "comment": "Malware payload (njrat)", "value": "746e511b6f9291eea51de5f16e65eeeb5341049cb82ad8abe13d01452e85e469", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638898044, "uuid": "3dc5b22b-1275-49d4-80af-918485b05540", "comment": "Malware payload (njrat)", "value": "2d9a66acba0e05de797f82d4a7b1d266d057078c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638898044, "uuid": "02169abc-f529-4642-b19d-8eec806b1acd", "comment": "Malware payload (njrat)", "value": "b3cc5c67ed3bbd1cf046a528072183d2a36ff4e33b335468090b2567d91416ca66b58461a66463ecbb78b925ca4fb4af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638898044, "uuid": "37d6ba38-d8b8-4215-a6e0-8f2f7f3df169", "value": "T1E9C2E72D37B68232D2EE067E4662DA9143B5D04BF227FB0E4CD958D94B1B7860A40FE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638898044, "uuid": "d54048aa-267f-4c95-a483-1590eecd2440", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638898044, "uuid": "0235fdbd-8f42-4d25-8712-1831dce85766", "value": "384:lLbIZoTmgEJbbwvqWGbPxZh7M9AQk93vmhm7UMKmIEecKdbXTzm9bVhcay6wr6eR:lYNfwj9A/vMHTi9bD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638898044, "uuid": "258be190-3c35-44ba-9eb2-bc06879f5e1e", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638898044, "uuid": "0a26af5a-9c0f-4ed3-984c-b9b134603898", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638898044, "uuid": "9c1909c2-e812-443a-94ee-54eedf65d8ff", "value": "a2105798edb6b4164a60c200ad1c4e3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f2fe8d-5787-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638899795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899795, "uuid": "32596e3e-2ab8-48dd-b9b9-f123482db644", "comment": "Malware payload", "value": "cdce90a10f2e9702d7fafd83631eea5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899795, "uuid": "9bd8d290-3fec-4a54-aa2e-3a7ccf1ce47c", "comment": "Malware payload", "value": "74a85ed80a3222cb8b97be0909787ba21cb93676db84c2fd33c2a612bd427874", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899795, "uuid": "515181cc-f111-4b04-a4a2-89df99d00a02", "comment": "Malware payload", "value": "1633608af8241a2fad65d88ae5e9c8d184655986", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899795, "uuid": "18c8cb3a-7221-44ef-82c1-9c98e119c223", "comment": "Malware payload", "value": "e5e2d122d1104b3f17fed63cce73521314cb36b601bd42b62cd3c791ceada8f7e3f68aedf9f43295ababa76196ed7177", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899795, "uuid": "cc8907c6-e78d-4c23-baf9-7cc850348ac2", "value": "T1C825126C3A9325CDD565037977BAE078422A3D769227E24EF49E320F2933B847533396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899795, "uuid": "46130916-0c10-44ac-b70b-f5c54dee7264", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899795, "uuid": "31cd38ea-ec4c-4447-ba39-76ac65bc6f63", "value": "24576:6pDQwmkA7sjZZBNqIq5RbDvnG8LztZyWlJuoBGG:6pDQwBZBEIqDbnztZ7BGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638899795, "uuid": "efbd1f5e-a2bb-4f4a-9b36-3cf58579c617", "value": 1031680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638899795, "uuid": "27119884-df8e-4832-82f1-a01de297ce42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899795, "uuid": "ef1e61e5-5892-4b2f-9642-8e171e03256d", "value": "cdce90a10f2e9702d7fafd83631eea5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9187c038-5772-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638891012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891012, "uuid": "2cd2f03e-9bd9-4d5c-b351-166b8e4f8839", "comment": "Malware payload (Formbook)", "value": "2e5ed849641983ec2fa93d678147e0f8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891012, "uuid": "fba7c9c5-3b66-4e35-935a-89dd608995d7", "comment": "Malware payload (Formbook)", "value": "75332a1cbe932060b22974c64aa21bbd53f2e7dd6c92d4c7a24cf2f3afc4068a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891012, "uuid": "f5dc9055-b96a-4de6-afea-11866c0ea383", "comment": "Malware payload (Formbook)", "value": "be88db585148a200ed580dcf928f3bfe03072fe9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891012, "uuid": "e4d44b7d-06f3-44e7-8491-808f29c788c8", "comment": "Malware payload (Formbook)", "value": "82c82c16c2fb5629030073b4c999e73b2e6c246dd7025a6ccfba0d7c3e4ddf22e8aa611833a14b2a48e19bd6c3903730", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891012, "uuid": "21ddae12-d405-4f77-84ae-9c314541813a", "value": "T102622DACC49341948F896BB86B2B9F85118C362EF784E632367C8B3567D6D7B111783C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891012, "uuid": "354b0142-5567-4e7f-af4c-e5d5087d22e1", "value": "384:fEnY5bsQwgBbujRQK17FJmNhzIB0zhokR:MYZsNqcx1RwNhc6zWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638891012, "uuid": "64448058-e26e-4890-be75-edf557640996", "value": 14607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638891012, "uuid": "4ec8e9d4-a6e2-40f5-aa13-312d1cf2e576", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891012, "uuid": "7c580c89-f929-4c56-bc9f-afead049886e", "value": "purchase order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07799baa-5751-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638876607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876607, "uuid": "0eb7bcb1-455b-476f-9d0c-f73cb00ef68f", "comment": "Malware payload (Formbook)", "value": "4b7a11562ca55592aa48d0a2d1086b84", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876607, "uuid": "022874df-2be8-44b3-96d9-af9434b8b8f3", "comment": "Malware payload (Formbook)", "value": "7544680ca64c3fb1d48aa3f826235577520526b26ef707f17f33c89618213510", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876607, "uuid": "9ee53dca-b7d6-40b0-9958-70ae8ad0aa96", "comment": "Malware payload (Formbook)", "value": "790a4f9d518afbe3dc40705e46edda80e3a3ad10", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876607, "uuid": "65d34794-d1ee-466c-8f75-1c6c02997638", "comment": "Malware payload (Formbook)", "value": "d7f0fd217c3c4b0e60f6fe7794d74c25f6800a13036e82da5a985d312299335dfdc1027412085bd9cbdbd95bddea6228", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876607, "uuid": "ce8f68f2-e177-41b3-be6d-76c374560f71", "value": "T1C53412D63430DAB6F6C333749A21162E4095AC6E098F7255C0ECB3AE9977CC431E9B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876607, "uuid": "7d585aaf-3f1e-484f-8eba-f32b85e10108", "value": "6144:JkmM6r/DrN4esubceNPJuDfOGEiySq3ybMheU:Jk4HrCNubceFJuDODScyVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638876607, "uuid": "b4e19359-2145-42c9-8860-a78925872ece", "value": 234392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638876607, "uuid": "944856dc-d09e-42a8-a2b9-ca59788cdc9d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876607, "uuid": "7cc34815-8571-4617-8c99-c4b267faeac4", "value": "Transfer Proposal-Sekou Conde.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fdad226-574d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1638874903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874903, "uuid": "7545e633-344f-431b-a015-262a615c83e5", "comment": "Malware payload (Amadey)", "value": "65d0653f5eec54a9a01b4d76c35c6c74", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874903, "uuid": "bd9802c2-9ac0-4b3f-b674-36b813feb307", "comment": "Malware payload (Amadey)", "value": "757387e6946c157cc37f67cf0a0e94af671b4a4bd498291390d878cc04cfa790", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874903, "uuid": "ee57f242-0583-42ed-a234-d2c499be7c5a", "comment": "Malware payload (Amadey)", "value": "10ac383cdad3a41f09ee9ac8c36365224ea6f826", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874903, "uuid": "5d9b3b7b-6d67-4d4c-8109-ba4a366525c3", "comment": "Malware payload (Amadey)", "value": "4c3c364dbaca7ac23f0e3ebe422ba3ee5ec9f544ba893b5eb6a63de4643f946a169673b9e68bc60f9d3272deb365f4b7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874903, "uuid": "38bb72f5-f328-44e5-ac21-6bb72963bb44", "value": "T11F648D10A6A0D435F1B712F85AB99369B93F7AF16B3490CF52D416EE5634AE0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874903, "uuid": "91707d3c-99ed-4aa4-956d-1b0edcf60c49", "value": "bd61429d86f194f3b84d97af55b8c371", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874903, "uuid": "bac7ab6e-4e5e-4285-b65d-3237b93466ad", "value": "6144:99eFQwudiDf0plmXq+o7PwUc1p6RzIOsRxjKkAyaeX:9+Ad68vUqL7Pwt1p6Rz7sRxJAoX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638874903, "uuid": "2c4fbc1b-d556-48d4-8960-d425be259143", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638874903, "uuid": "f3c1d159-e89d-49b5-bc32-40a4855ad525", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874903, "uuid": "d80a1b49-0a0e-4d77-887a-1c8977fbc6d7", "value": "65d0653f5eec54a9a01b4d76c35c6c74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7398fc0-572d-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638861413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638861413, "uuid": "a713e694-15bd-4dc5-9b7e-e7c51d9f506b", "comment": "Malware payload (AgentTesla)", "value": "347560c21c1e5f7064db5e1433b2232f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638861413, "uuid": "877c97c9-cef9-444f-a0d0-c5312134e210", "comment": "Malware payload (AgentTesla)", "value": "7639c5ec4b09c0b840baeead7b82fdd8d69bfa1a3b631581f25e2ea5edfb51b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638861413, "uuid": "224e5730-cdf5-46d9-b336-98a3224a7da4", "comment": "Malware payload (AgentTesla)", "value": "dc5fb33af767ac703a04b23512bfe1d7589a73cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638861413, "uuid": "6d594fe5-163b-477a-8ff8-b11945f8aea7", "comment": "Malware payload (AgentTesla)", "value": "42d1e9ebfba780979a592fb880c2cc39d4903390df7c106f38e76a7dde9485144a662047f076112fb351e6a013a8ac4b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638861413, "uuid": "463929cf-a67b-4d94-8b9f-c471d9bc6f87", "value": "T13CB4DF4936D6D2D8FC7BE7F90CB075C10778F2E4E981E2DEED94216AA8A27904F14172", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638861413, "uuid": "b2a5c954-20b0-4e31-8066-3ab263aedb12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638861413, "uuid": "c40d70de-f4e9-4015-a41a-540a73b27bb4", "value": "12288:M+Fa2iNtcGmR7tZroXdMQC8dqmfLSTIC+v7WK:M+Fa10GmJt5oXWX2qfd+jW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638861413, "uuid": "747d0680-06c4-4a05-9a2f-a7db23870fac", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638861413, "uuid": "68d8e33a-1424-42e0-b670-f7e7689b9136", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638861413, "uuid": "f1b09a54-ea5d-4bc9-8ecf-20f2ced7bb97", "value": "NEW ORDER (PO 153755577).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16572dad-5775-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638892093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892093, "uuid": "dc9d7766-acfa-4c83-8795-27144858f0bf", "comment": "Malware payload (AgentTesla)", "value": "3e5ac643441201e7ed5f80678a92ebb0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892093, "uuid": "754876cb-3eeb-469b-bd7b-d2521d91e89a", "comment": "Malware payload (AgentTesla)", "value": "7657b86c0673448c0e6f7427fbe671007c689e64da1c5ba134e367fa41246fba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892093, "uuid": "e280b576-119b-438c-854f-07e0bf378929", "comment": "Malware payload (AgentTesla)", "value": "d8e0e1432f71226a4f591b848aaf2c51a6fd0a62", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892093, "uuid": "d766bf68-ae76-4111-92cd-3fdd99fbbb9b", "comment": "Malware payload (AgentTesla)", "value": "df20beac254d7b5a6375fd9b6a07659cb54b00f7edae0fb8f78a5c151c4ba7ac75f32709fceaba6e97f732979d5c269e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892093, "uuid": "d951077a-7e8d-4f77-943c-df4361dcef01", "value": "T11F55CEFDAE935E8CF82C0A3427E9C75002E65CF5E636B16ED790B95A02732F52192D43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892093, "uuid": "41d78133-8b15-4f82-8dcb-d35eb447a4b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892093, "uuid": "ae4e9ce2-4bba-4823-9b63-ea846352ddfa", "value": "24576:jKNWz3vpxd2vdd01apQ6FexzM9wBLA3rICvSb69qkAbFOHnKO5er/SV:YWz3gvddoaEzaIA3rICZYnbF4KmQ/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638892093, "uuid": "21daf347-4849-4b97-906d-a00bbdcf1979", "value": 1287168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638892093, "uuid": "e15d4dfe-f598-43ca-9238-1dc0f54c3e52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892093, "uuid": "bc5cd6fe-da7b-49b2-9bd7-e547bcb1775a", "value": "3e5ac643441201e7ed5f80678a92ebb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a4db86-5751-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638876845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876845, "uuid": "146aef18-e25d-4afe-bc8a-2daa76f13d87", "comment": "Malware payload", "value": "f9d2aad3c05e3cbde113e5f4c693571b", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876845, "uuid": "fdfcf794-49e8-4e65-9de9-d8a7e7d3b784", "comment": "Malware payload", "value": "76f3fee21ac933da34ef61ea90ca28fb8e2683473dde0da7c131e802b4ccf974", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876845, "uuid": "b6652d48-1f93-45d7-abe6-1a530bb25b40", "comment": "Malware payload", "value": "8232dd5ef2459b27f0aab7dd5bd4025232fa28ae", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876845, "uuid": "a3831b49-54cf-4c0d-84c5-8f5c6cd8c842", "comment": "Malware payload", "value": "8b1f4afb3ba7de6f2161378b6d3888145cd6d9a5725eef46dc7ceeb90106707812b15c15f89b753023ddea3a22c1e9f0", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876845, "uuid": "59ac94aa-d8bb-414b-aa3f-2037a1460284", "value": "T1F63413E6361ECAC3D5A9A335BF627490962ADCBD6ECC8F63D2ED302240B54113D41B97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876845, "uuid": "44c3088f-75ca-4352-8319-0d181c633d07", "value": "3072:3POvCLRFfELIus2PuIAWCDE060QVHAJJgQOR51b+IhaBdwAuZPbXicOnVPJ3E4:fTLRhEcvSCDi0QVK051ZsLFeLqVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638876845, "uuid": "8e725214-07a7-4f5a-baac-7f6f6f4b403e", "value": 234792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638876845, "uuid": "ab033321-1a8e-4f83-9723-4d139b43a659", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876845, "uuid": "038890e3-6f00-4adc-9b0a-d03d1eca3d75", "value": "EASTERN HOUSEWARE LIMITED.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448d622f-5765-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638885299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638885299, "uuid": "a37d0f1e-7731-4b35-8fa1-4bc2fafc8d43", "comment": "Malware payload (Heodo)", "value": "de21d398ea6252557bd05f735947279e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638885299, "uuid": "db77e42b-0862-41d2-90a7-7b0c9476add4", "comment": "Malware payload (Heodo)", "value": "77398a0b6ee4bf70c270f7f3f081ebd36093c0f7b50203d590ac174bf2998376", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638885299, "uuid": "57cd22bf-d49d-4466-9ccd-a2543e88f481", "comment": "Malware payload (Heodo)", "value": "3b572a0dd0251d36391476276ecedb57c79b9938", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638885299, "uuid": "138cb53f-a39d-4275-b6dd-a93c4908acd9", "comment": "Malware payload (Heodo)", "value": "b0204dd1dd954e5aae65f38896584001dc7f0a63c3368517a5fad542936691ee212e05fdf1050efc300a2203858a703a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638885299, "uuid": "5a1fef79-735f-4b59-9c3c-924db51e5ad0", "value": "T114F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638885299, "uuid": "13daffca-dc35-4f52-adc1-cae79688308f", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638885299, "uuid": "ee2185a3-4909-40e2-802b-3182aa2473dd", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/I:JapiKiBEmj4GbOX399Md9J/0TG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638885299, "uuid": "b09538e2-85f8-4188-9381-58db82eecc6b", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638885299, "uuid": "c80da549-92dd-4f99-aef0-b68300e157ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638885299, "uuid": "920e6415-186e-4fcd-b91b-d0ae00e45cc8", "value": "X5JSZFq3nKH3LO1v4nfsV.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4ab394c-5756-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638879018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879018, "uuid": "b8a1d2be-527c-4bc0-822f-45016e271bfa", "comment": "Malware payload (Mirai)", "value": "a82fa5476fdb41d3a18c8807868bbda1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879018, "uuid": "93a19950-38fa-4d08-b0a2-0a12b64909b5", "comment": "Malware payload (Mirai)", "value": "776599ddaf67de227e8621931862b320c0856d1ad4e0aa72b9f561797c972bde", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879018, "uuid": "5190dbee-4fb4-4bd6-ad87-6dbd72779016", "comment": "Malware payload (Mirai)", "value": "4ee7a04c33fb1234b4450a13732cde336693b9af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879018, "uuid": "2d00faf7-00c3-412b-b836-e85214119a9b", "comment": "Malware payload (Mirai)", "value": "42e27ea0239ddacbae1d48f423cfa48e068203811f85c0a4f7b4954b7b13d9757bc40d38a7b5fddd1067b546a7f9df9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879018, "uuid": "32d479c9-3590-4b76-a7c8-87153bfba5ce", "value": "T1BC331A92B8D29A26C5D023BAFE6E518D332163E8D1DF3217DD241B193ACA51F0EB7741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879018, "uuid": "38df1ae5-1f81-4ba1-be34-7e0286706832", "value": "1536:UBnug/ljoa4aGCy5Q2F2FZ+r3S56Q0PySt5REi7xc:UBnttum82F0riwlqSt5RC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638879018, "uuid": "efe4a8e8-dbdc-4f95-b561-77f1b24d0cb4", "value": 52448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638879018, "uuid": "b4b9ac2f-4b26-4f6c-a812-4cabfc229c82", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879018, "uuid": "9fb36ad6-e5fd-4569-ab1a-1fd4b8a63e87", "value": "a82fa5476fdb41d3a18c8807868bbda1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e0861f-575d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638881914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881914, "uuid": "aea84b7a-c701-45a3-ae46-c4d1c8bbe5c2", "comment": "Malware payload (Loki)", "value": "d131738343d3d9a57d7d0c9aa1dc30cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881914, "uuid": "36382ddc-5236-4b85-a8cb-d2d7eaa27bed", "comment": "Malware payload (Loki)", "value": "779fab5e3826ba8165c00507f22d08a0a81dd321d36b3426190565d87c1ffe6b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881914, "uuid": "c105f388-7b00-4246-b891-195e5e738d56", "comment": "Malware payload (Loki)", "value": "f78ceafb6ca40ed1fc14aef37166a249a4291891", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881914, "uuid": "4203c71d-18de-4181-8549-22e836bcda90", "comment": "Malware payload (Loki)", "value": "e9da264c40dca481fde6d4b58033014479fc5cb2d31a73a08f934ad206e9c2af2c45fbd17c54209e92bf9975e3b7df59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881914, "uuid": "955236a2-9639-4f35-8679-5d1931ee7da6", "value": "T1011522FD396754DFC98045B533AA903812F23D3A261BE19EE8697A2F083B7C53933152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881914, "uuid": "9fa6cfe1-5416-4813-a9df-42835242f217", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881914, "uuid": "00b1527d-38aa-410f-b3e3-c9ca8f45aad6", "value": "24576:2epgoUtM2N+bkLn6AlkOoSXZtkUhBNnpxF:9psOs6AlTXZyUtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881914, "uuid": "8d61b37b-6b4d-4e3d-bdfb-66618c19f174", "value": 954880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881914, "uuid": "355f50fc-1963-44b8-8be2-ff87a7c20aca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881914, "uuid": "1cf3480b-b63b-454b-ae0d-2c5d9459e7fa", "value": "d131738343d3d9a57d7d0c9aa1dc30cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a99afa-5737-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1638865700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638865700, "uuid": "7b810fbb-6aea-42c3-b24c-2f77d5ad5c74", "comment": "Malware payload (RemcosRAT)", "value": "954737e35b988d79f9dc7a81597c8d37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638865700, "uuid": "47f57e77-48a4-48a1-a122-670cbbe7e466", "comment": "Malware payload (RemcosRAT)", "value": "78900ed7307ae31ad9b74204fd8e4798b01a6b7bc593e70d4a7aaab7ab1b2b95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638865700, "uuid": "1ff7a5dd-9fff-4757-bdf4-7933e03a8efd", "comment": "Malware payload (RemcosRAT)", "value": "48e8376824041a18108c4df61970301fab5e6f8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638865700, "uuid": "a2a2a021-49bc-4ebe-91cb-8d6f41867e25", "comment": "Malware payload (RemcosRAT)", "value": "179f876febebcf9daa28e295b426eedc723deacaf01922a6e51143f7c6580f89350d80ac8b97faa962c61aa819d50aae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638865700, "uuid": "f0eaf456-4951-482c-b00c-8ba66a05cba1", "value": "T1B925AE15B240F873D13B56B98C27E3E81829BF21AE54EC8637EA6D1E0EF4650BC15397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638865700, "uuid": "047e5a72-f0df-458e-bc5c-483da9621cec", "value": "c994513c4cf2244ab09c2ce0f6794e8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638865700, "uuid": "092eb3a0-cfef-4478-b119-e1fa79fef1ad", "value": "24576:naEZ5SuZicyXtz1QDH/DeZhvrly444444444444444444444444444444444444w:naYcsicm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638865700, "uuid": "41974f95-252d-42f7-863e-3801b1de8abd", "value": 1044480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638865700, "uuid": "29282d5c-85b4-4571-a3b1-9fc912bb5da5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638865700, "uuid": "499a306c-4278-4d79-9834-de158644e9a1", "value": "VERG\u0130 \u00d6DEME FATURASI 7 ARALIK 2021 SALI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52bd1624-5764-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1638884893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884893, "uuid": "2971bd5d-445d-49ff-b695-cb915ec877ea", "comment": "Malware payload (SnakeKeylogger)", "value": "4ff8e77b9cbb969ab8b860e53312cb4b", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884893, "uuid": "140bec16-a4a0-48f9-9468-5d8c5410476e", "comment": "Malware payload (SnakeKeylogger)", "value": "789eed93a541bae05ba1ac52e4863e44362115b9a7cf5d9a9033a47873242862", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884893, "uuid": "1e68771c-e64c-430b-ae4e-9ad1020488b9", "comment": "Malware payload (SnakeKeylogger)", "value": "7103eb7a5b32bceb00a1c937ec2d68a1e427cab4", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884893, "uuid": "9d651b99-a150-441a-8d95-91513ca14435", "comment": "Malware payload (SnakeKeylogger)", "value": "ed65b00f12c7d41b1e31feba39c4afc3b8ceb7d8b2e1046dd5f7e3afb912c00d5c9f2aed709d5ae75a71bf17c25c9040", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884893, "uuid": "2eefc519-8216-412b-ae73-be0b4cdeeb64", "value": "T1D913F29F672E585E599670203BA570C3188D55CEE0B11EC0D20E5B3EB3A692777E2EF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884893, "uuid": "4f89c510-0550-4fcd-ad34-e969c21ff43c", "value": "768:FBBlk5+a6SjSTvd2qG8U9NXBDDsKnFBV7+3X7Hya6hvnqHsaB6r1tUCqtUD6X:r45+V82UvBPsKFX7+7Hya6hvqLB2qT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638884893, "uuid": "185e4557-2dad-49f6-8457-934777bf3cea", "value": 42560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638884893, "uuid": "a5e819e5-9063-491d-8f39-066f6f4fc7f0", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884893, "uuid": "504b6050-6f76-43a7-b854-ff7f347ab087", "value": "BANK DETAILS.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b89faeb-5774-11ec-96a4-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1638891753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891753, "uuid": "7720b5bf-70b4-415d-a2e9-70bbc437886a", "comment": "Malware payload (OskiStealer)", "value": "4694fd43d8e4fa2e93266c9a93475ed9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891753, "uuid": "da3f026f-a032-4b5c-ae65-05b6c441edb4", "comment": "Malware payload (OskiStealer)", "value": "78acc7d2e613bc812bb1234cb88b6516f957e7ef6980dd211fdbb9f4741f88cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891753, "uuid": "d69295ac-4b6a-43d1-b0e8-7b996d0678a3", "comment": "Malware payload (OskiStealer)", "value": "446bc903be6c1621b754722885d6c14c5e4fcdaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891753, "uuid": "8ff51994-f510-45dc-88bc-77625a76bb69", "comment": "Malware payload (OskiStealer)", "value": "9155ac974ffadd01af940032b43e1a19bd31f95283f2866bedc5a05c6e9ae2d13142682db4e83eff0281d436dec59a49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891753, "uuid": "bb653fea-9cde-462f-8d42-615eb69a4aa9", "value": "T1EA3512AC39A786CEC261937577AEC13002A67DB66513C26EE89A331F19337817933357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891753, "uuid": "4ddaf562-b5e8-43a8-b2ab-a68b533c5a4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891753, "uuid": "29a3f1d2-0e1b-4224-8370-7c0eeca818bb", "value": "24576:ag9B4sv4JsbgROMHwnIH+czt4Cvik8CtSE3FluhzYSkhYZoY5gSmkGG:T9sigArIH/ip+SE1ludMYZ7nJGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638891753, "uuid": "6eaae3ce-ad9c-4478-81be-6970a0f6240b", "value": 1109504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638891753, "uuid": "a602fae8-4a08-4a1f-b693-396e56ca4bc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891753, "uuid": "99662dd5-5ad6-44e1-b5d9-ca871f6d1039", "value": "4694fd43d8e4fa2e93266c9a93475ed9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b39f38-579d-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638909574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638909574, "uuid": "cae905d4-7074-46f4-a964-188af650495d", "comment": "Malware payload", "value": "4f22bc555c3bc7e13022e58f8e2717eb", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638909574, "uuid": "7105a793-8890-428b-9788-b0c550611231", "comment": "Malware payload", "value": "78d3d78f6bd90fee7bbd25a15bab36b89072dc738183442d9a6a2d9622835840", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638909574, "uuid": "c1b36f90-0227-46e8-ace3-963ce63b9967", "comment": "Malware payload", "value": "61f0f882557314a4c93102340a7c94703cffa433", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638909574, "uuid": "550a6822-f899-4e29-96ef-e755d38e7904", "comment": "Malware payload", "value": "c8f807c97c266b20ce62af60d292d605ba22b5d3d0aeb833d4cff31feba266d8a26b0be4f40966e8b867a476e79a5d87", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638909574, "uuid": "4473f0e2-4552-49ac-8745-94f289bb7023", "value": "T1E274D1E0ADD811815B8ACB07A2F2F6A7527F122E57033E36482B225F5F254F4C35AD5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638909574, "uuid": "92b4f18b-7f3e-4a7e-b6bf-002f0d7a301c", "value": "6144:2KJfC/NzSjeUNW9hQeq3iw6jDcgsvcWoRf+hXlRS9/oVQSjEm:2Q2SmhQeVwcDcg8oRfGXHG/oVum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638909574, "uuid": "314a85ee-4ec5-473f-b776-c5ecaf440c72", "value": 357295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638909574, "uuid": "201817c5-c9d3-40ce-8ecf-55de9d616f17", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638909574, "uuid": "e72f2368-e23c-474d-af4e-2b241999612b", "value": "logitech.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57398bb8-5763-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638884471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884471, "uuid": "41953323-b7ac-4da7-8102-8de515ca0865", "comment": "Malware payload (Loki)", "value": "fbc1d7cd472d34d7bfae9c8835539e40", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884471, "uuid": "bb8e3542-7917-478a-91c5-add5f49297e1", "comment": "Malware payload (Loki)", "value": "7a94391eeeee3c5bc742105a4944345d8d3c0c616d002b00a77bf8b48eabdd1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884471, "uuid": "a536b864-4186-452e-9617-4988cad23393", "comment": "Malware payload (Loki)", "value": "27a53cb05d251a1bab754d902e3e7c69389d9987", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884471, "uuid": "357ee727-80c5-44b9-9c98-25343d5487dd", "comment": "Malware payload (Loki)", "value": "47594cf3a890e68720fb8ba82af39bdac4d39796a2046b46563586de1683dcbdbe21a94fc8b179cdafa67ffc966ee768", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884471, "uuid": "a61b3961-fbd4-46df-9303-0b263d47a83e", "value": "T1DFC4F12477F8AF56C8B84BFC416B26048FF4751BE002DB9A0EC235CB2AA2F535A15D57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884471, "uuid": "5be357db-998f-48e8-93a3-260b09b5c96b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884471, "uuid": "c7c5b74a-767c-4ab4-8b82-674b49be514d", "value": "12288:sOjwBJ1j0jyoAaRdOKbSW5w4EHasLh6IBUGMBJ1:sXBJl0j3AaRdOe2THasLh6I8BJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638884471, "uuid": "6825c0a0-9215-4800-8bc4-402d3b5a77dc", "value": 544256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638884471, "uuid": "e753b0c0-07d5-4650-a1aa-a3a0da25a77a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884471, "uuid": "ac07631e-8831-416e-8dba-b1f26fafa1ce", "value": "fbc1d7cd472d34d7bfae9c8835539e40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d91ade-5728-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638859016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638859016, "uuid": "255ad84b-d8bb-47c3-bd5a-88e6f8745d46", "comment": "Malware payload (Formbook)", "value": "2761dc6006d4670948575a5b09e54812", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638859016, "uuid": "fb264233-05b0-4dfb-aa0d-326e2a810f01", "comment": "Malware payload (Formbook)", "value": "7b0a8b41f5cf2bf97bce754030ab9dcd0ad12a7a654792dde8fff1f779c13d77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638859016, "uuid": "182ab6ec-e456-4767-9e0d-05893f792a2c", "comment": "Malware payload (Formbook)", "value": "01369f956f3cf5079320acc881084172d743c420", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638859016, "uuid": "1bf71978-369b-41fe-88c0-c8afc7411b9e", "comment": "Malware payload (Formbook)", "value": "e25cc881fb73247fcb9e320adb3551fe19e216e5d3d7dfc6fcb7d3c7fae80601bc87cf5b215dad623fed1764bcd93086", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638859016, "uuid": "cb4eb827-26c1-417e-8b49-dbba175eba9b", "value": "T11B2523142FA18A28C438AF77345140B8037626FAED55F68B5FC375FE2AB97C69603C16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638859016, "uuid": "2fd9c96a-3678-437d-adfb-953dcd7750c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638859016, "uuid": "23ee3dc0-91e5-4550-95df-9a7b769f2fd3", "value": "24576:MsV5MzPLz8uMnleSQYTXp+mhNX7lJ7Udav:LVGzDz8dl3QE4mhNX7j7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638859016, "uuid": "9b5bb2fd-7b81-4861-9444-2b080dc1b357", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638859016, "uuid": "41f0d600-ca48-4801-9391-fb48de424bef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638859016, "uuid": "1335c681-2bb7-4019-9638-b837189c4f72", "value": "dSamples7qU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1685d75-5766-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638885965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638885965, "uuid": "69a4ca30-61d3-4e98-b616-707b2e580e39", "comment": "Malware payload (Formbook)", "value": "a8538dba14e963ac7894257f7466bc06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638885965, "uuid": "5d93fab6-370b-433d-a565-678a97409134", "comment": "Malware payload (Formbook)", "value": "7bfabb3e53f70e2ad39155a8af8d7e27a07ec01b0ba8faed52cb569e4f78142f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638885965, "uuid": "58f096c5-4999-4444-a878-d321b11a358d", "comment": "Malware payload (Formbook)", "value": "d5de28b9a2f41519f8ae6fc2be6f9ee75569e192", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638885965, "uuid": "0978b7c0-e156-485d-9855-52fa9029bd67", "comment": "Malware payload (Formbook)", "value": "afd9d6ace164fda117d410f3bcee080d49a64e4e067e945f36e03f4264d3a5f7976b0aa25844357e53afb5a3948ece26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638885965, "uuid": "568e8b65-3d53-480c-b9b2-40155bc472e1", "value": "T170B4D0B57FE4D663F38400B59166E7A88BB4952C5B43080FFCBE7C6EF2753588819286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638885965, "uuid": "cd0e4627-93e8-4b59-8567-4bd7b4372649", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638885965, "uuid": "b235e093-1406-4046-8f57-816e09eff02e", "value": "12288:CXGORocNeuJqQS/+sKlQwbgs18YWZhvbx:4LTq5Wvg2WZhv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638885965, "uuid": "c9c4a73d-c2db-408a-8237-aecef882b3ef", "value": 527956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638885965, "uuid": "128ca4fb-5b4a-4d09-a9d1-c5d126e8dbdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638885965, "uuid": "de130ea6-41fd-4cee-a6c7-77bee7836bfa", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582d6511-576c-11ec-96a4-42010a9c0029", "comment": "Malware payload (HawkEye)", "timestamp": 1638888338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638888338, "uuid": "bfe71928-263a-4f2d-9cc8-a5675dddc025", "comment": "Malware payload (HawkEye)", "value": "3f332b62eee0970f3189c689d5bd042a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638888338, "uuid": "3480c3c0-55f9-4baf-bb48-13b215998652", "comment": "Malware payload (HawkEye)", "value": "7c7983ada08828ea0c0ed5b17b05f8dad5bf6fa44e1a4692c37f18c340e14219", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638888338, "uuid": "eeabac58-256b-4753-9e04-099a62617341", "comment": "Malware payload (HawkEye)", "value": "f68f7dcc8ffcdd3f93333e711779e8d02db2dfae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638888338, "uuid": "622759d5-31d0-4f5d-8629-f3fd0205e133", "comment": "Malware payload (HawkEye)", "value": "c9449b8e2df9734b0235fffc840750b8ddbde9c3e5596a120ec85b2f68f4c1a21c8906035adb11b4dc1fc03059421661", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638888338, "uuid": "431b42b5-d5ab-4a26-b0bc-b194e40447f1", "value": "T1E005CE893F9277EFC4AA7134C614ED58832FAA84EBE1517596F13EC92460F738A83171", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638888338, "uuid": "a98d3d77-17d2-4de2-8515-5fb8eec81f03", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638888338, "uuid": "9695dabb-cc40-4572-98f0-51c75a2441ca", "value": "12288:WOe0qo8EWUK1CLF54EMctn6zleqHXFD/ABuqYrNav+qSz4SglH2zbr:WpZwW9cxjn6z917Nq+BVcSg12r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638888338, "uuid": "87602e00-3788-4e6d-9ba0-1de2fecdeea5", "value": 852277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638888338, "uuid": "aa60dd43-f7c9-4fbb-9e9d-743aea42a78b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638888338, "uuid": "b946de77-dfb8-4cd6-a903-09c05250f6b1", "value": "5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99cae9b9-5764-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638885013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638885013, "uuid": "52fae35a-7400-4fe0-a0ae-fa5833968dcd", "comment": "Malware payload", "value": "9cd9eef4a89b76b49da819ae0165c93a", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638885013, "uuid": "4f688ca3-a745-4651-bd10-4b1d5ba6d0ac", "comment": "Malware payload", "value": "7e320c70a70dfbecd8e9020e8abc7562f245bb4cca301fcd3c683619b60477c6", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638885013, "uuid": "819ad5e1-a2c0-4600-ad1d-1112700309bc", "comment": "Malware payload", "value": "7047a6eb98940ac7877779f3f9fdd719fe04edf7", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638885013, "uuid": "012cfa06-381b-4f10-a231-eb1b55f792ad", "comment": "Malware payload", "value": "a01b25e7aa517fa2d09efcc01040dbbebb47d8cbb8cd3421864cf15d8697c46806131390da41e7b53bfd9adc7c39ce8c", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638885013, "uuid": "6cf93784-2aa2-491f-adba-7c8a4ff6778f", "value": "T1E53418B295D80CD1FD9A177958A0121ABF70BA744766D7231CC8A9FF0E4F6E00E2D366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638885013, "uuid": "1227b1b0-f3a2-468d-ae93-b499dbd78ae9", "value": "5700b93a6077ba744dca7deb40eefe15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638885013, "uuid": "afb381d2-fe39-430e-862d-850cd41740de", "value": "3072:P9DzWso9C7auA3Gc/IWWdooC7a0AJlQGVZ73aK7fJQlkC8y6beejJhumlL/p9Qce:P9w2m2c/pB4zPT//jQcwx9cftA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638885013, "uuid": "70572363-6ec5-46bc-83e9-99fcc2b04de0", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638885013, "uuid": "c4073268-89c1-4f45-912b-72ae7dcfd818", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638885013, "uuid": "9df60d86-2f20-4376-8a97-20ae481b0b39", "value": "Final Invoice& Packing List.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf5dcea2-5752-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1638877371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877371, "uuid": "8cca89e0-5870-4c2b-9583-9ef591a8d844", "comment": "Malware payload (Vjw0rm)", "value": "9bd8e7e536835eda37c163bd0d70891e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877371, "uuid": "4bebcd1b-f084-42c5-9715-b0fa1c2eb3ae", "comment": "Malware payload (Vjw0rm)", "value": "7f51e1a5d533ee7452481589b6cf94d3cbdd84e4b6a1eb904fefba248eea3efb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877371, "uuid": "993465b7-17b8-486b-9745-330941be8cd4", "comment": "Malware payload (Vjw0rm)", "value": "be0e48ae96497ce8dbc03a51b194ab39fcd6d192", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877371, "uuid": "c99e92f2-4375-42cb-92f2-90262ab54fdf", "comment": "Malware payload (Vjw0rm)", "value": "5878027bbc6bfb9c90b8a4862bb7a2e10cfc19fbebd37f89721e8fffd86d7b212615484f4284d29303b1c7896dc4258e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877371, "uuid": "ee75a3c5-ae6f-4943-b997-80e012dd0039", "value": "T1F0A427986B40A9D9D9249577F07A29CA93F6231BD00193CCB99D36031B7EF44C3DAEB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877371, "uuid": "e19549b8-21c7-4f9c-b8b7-1a7627f2e4dc", "value": "6144:5IpUVoffzyEazzCabPRg6S4R8eOLSdqXvhvuiPKbg8taqHaBo1:5ovzRajRg6S4wSdqXnP988qE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638877371, "uuid": "b306d6c9-46ab-418b-b412-e8a2282ac2cf", "value": 484407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638877371, "uuid": "eca37ff0-bb3e-4b16-b75c-208a7b26562f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877371, "uuid": "e3f9b7c9-7288-4981-a3dc-f59f5fbb8ca8", "value": "KBH-2092949189.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a565f9d7-5769-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638887179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887179, "uuid": "a728ce3e-801e-43cf-9043-fafbfa664e1a", "comment": "Malware payload (Mirai)", "value": "cebf2b3bc35add8e27baf0eef8a0fc01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887179, "uuid": "ac22ed5b-f3f9-46af-b652-780385163d51", "comment": "Malware payload (Mirai)", "value": "7f9cb45331e01be2e673d7794953c62bd048b2016e43133b6068b9d5b4fe5b38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887179, "uuid": "dc569719-f38a-49dd-aa9d-597ac395332b", "comment": "Malware payload (Mirai)", "value": "7135204230db0b1c53b2a606bac3127bad718bca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887179, "uuid": "3ee9384a-017b-43c3-ad38-57be7090f66d", "comment": "Malware payload (Mirai)", "value": "c8dd89f87959fd795bbfb89ad621a980bf50cf4ad799af4e834abdf519704ab4e70c16b5c279b6186d3c5f43689f1750", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887179, "uuid": "d4398a2b-31d3-4ddf-bde9-4961dc86c75b", "value": "T1F513F11D1614089EFB3EE17F8BA11B980AB05F6B21066E4E774665B1DE986AC3013BF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887179, "uuid": "35fcdb3e-b5f7-4d47-9ec8-cec445453d80", "value": "768:ksTtzdAvbilndcQ8N+rW44YMUMZkit3MNJgGlzDpbuR1JZbzQ+BKt2iXVu:koUvbuiQ8wqYMUYl5MnVJu3Q+BgFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638887179, "uuid": "9f7dd2d8-f64e-43e6-b3cc-7430e67b358d", "value": 43948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638887179, "uuid": "39c6778c-c6e8-4ac4-9a43-3c31dcb72966", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887179, "uuid": "ca3b4040-36d1-4e21-8978-5e8e1aa3a722", "value": "cebf2b3bc35add8e27baf0eef8a0fc01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4228d53f-578b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1638901616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901616, "uuid": "e0dfc910-7c69-4f3a-85e8-be0f99ecdcc9", "comment": "Malware payload (Gafgyt)", "value": "e8484c986eab10e6f69ec886db61d688", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901616, "uuid": "d36cfcd9-596b-4084-927c-d4f88ed8601d", "comment": "Malware payload (Gafgyt)", "value": "7fdf11250efa64991245ce9fd36603c5250b46dee5dc9624b676b7de2c30f720", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901616, "uuid": "c21365fd-62e5-4586-aa0f-d03c90b3dec6", "comment": "Malware payload (Gafgyt)", "value": "44b59327251fb245c3ec5755a20385171bd3bb30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901616, "uuid": "95e410ec-0df6-4da5-b888-2110fde63f60", "comment": "Malware payload (Gafgyt)", "value": "2cf69d2600d8d5bbe8fbb324c8cbe2330bb9d9b12e78599fbb38dcd526f5589fbdb2305f5a172676521924bae3afc496", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901616, "uuid": "00901608-a068-45c3-9bfd-795f15798648", "value": "T114835B25B93A2E17C0E4A07B42B78329B2F6274E24B4C71DBD720E4EFF196902457976", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901616, "uuid": "e71933ac-5b5c-4252-a53d-67c7f2048b91", "value": "1536:989ZMhSciiTprs0MiJBRv45K85ElIfeEpNIwcT+3h:ciYi22Q5UlIfewcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638901616, "uuid": "d0d34d34-5480-430a-ab49-d5db5ff45172", "value": 85768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638901616, "uuid": "ce6c60ce-6309-49b6-a57e-9fbe67289952", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901616, "uuid": "84c6d2c0-345c-47e1-8843-2b36ee958e95", "value": "e8484c986eab10e6f69ec886db61d688", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e106dba-5753-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1638877584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877584, "uuid": "939d8356-e60d-4d36-9818-7d8b312678f0", "comment": "Malware payload (Vjw0rm)", "value": "262687b7aff644cea1a76fc57da4cc9f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877584, "uuid": "078ee1ce-39dd-4c1b-bc56-23fcd8db48f7", "comment": "Malware payload (Vjw0rm)", "value": "800bd31c44aa12fd62c8068878f1cb6479143792b0b99750be64d3aca407e0e4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877584, "uuid": "8c6a3970-9a02-4d02-bd2d-affc480226e8", "comment": "Malware payload (Vjw0rm)", "value": "eaef6f314389d0462d3c59e7974f2dd39a219dc1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877584, "uuid": "255fe27d-9164-4fbf-bf54-b54e71042e77", "comment": "Malware payload (Vjw0rm)", "value": "fdf3e51461bf24675c051611512a9761cabf34d411d3ee5df7aeaa668b88887381e81ec19a7cb2ebaa9f42f67431cd84", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877584, "uuid": "b0b64630-f387-4a09-9e85-ca4d3290db1f", "value": "T1C1A427A86B40A9D9D9249677F07A29D993F6231BD00193CCB9AD36031B7EF04C3D9E74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877584, "uuid": "43938113-fdca-4175-898b-cc3aa99e1f7c", "value": "6144:5AY/xoHbDmFa2nXmeDPdg620ho+mbqyOyrFH2i7KfEc5quTqtkN:5AY0DZebdg6200qxyrf7ZcUugG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638877584, "uuid": "d3a90b56-faee-4b09-aaeb-e9b03d684972", "value": 484407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638877584, "uuid": "207fb4e1-23b7-496b-aa6f-e6673c430a22", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877584, "uuid": "96ee7ef9-2116-4762-a471-ef2ad86341e7", "value": "KBH-209294917.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e847e06-574a-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1638873854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873854, "uuid": "8cc758c0-2f2a-4b1b-ad6f-8e9562048224", "comment": "Malware payload (RaccoonStealer)", "value": "12e524ab34859f7ffdc7f92cdbe2e283", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873854, "uuid": "8282cffc-0f3f-4b75-afab-1110e0dcc06e", "comment": "Malware payload (RaccoonStealer)", "value": "8016cf2a984909cad748683e27ecef70a65c417317b55e8b4031d0aec1f10f06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873854, "uuid": "9327513f-ca2e-449d-9b8e-38e564fb6727", "comment": "Malware payload (RaccoonStealer)", "value": "3e7b2ac54d1523be93df208c33721a97bec0cb67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873854, "uuid": "2955089c-878f-4850-94e6-00f77f1229a0", "comment": "Malware payload (RaccoonStealer)", "value": "855898749104e3d6819ad444ef5895995d23eb1b56f4fc807ad80be0f7cdef55a1c1cddd79545ce42da6b1038abd068b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873854, "uuid": "b8c15c59-d8a4-42e3-ae7e-439ccd7b68c6", "value": "T1ECC4E010B7A0C035F5F722F859B99269B52F79A16B3890CF22D516EE4634AF0EC3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873854, "uuid": "291b08cf-d9c1-4547-9f33-fe2156cf5b34", "value": "9a4fc332982336bed32e6b1dc80be347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873854, "uuid": "cc8f8784-99e7-499a-9c5a-e5050c10d3fd", "value": "12288:H6ehN+7ATAguCJ7ESjhrw1Oy6PqigXIzrRyFmRq2ywhEX5bbs:P7+u3ESxqikOV1qnJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638873854, "uuid": "f3681cf4-57d7-4806-8314-f3cf2dbf01f8", "value": 584192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638873854, "uuid": "3cd1f0dd-a73c-4832-b7e6-10a771b92ec5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873854, "uuid": "16e3fed0-66e7-42c3-bb25-93536f274480", "value": "12e524ab34859f7ffdc7f92cdbe2e283.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fdaa7d6-5799-11ec-96a4-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1638907544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907544, "uuid": "56d21463-2754-434f-8c7a-af7982ea7222", "comment": "Malware payload (ArkeiStealer)", "value": "d860635483b145289d8c3d14fe7acd31", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907544, "uuid": "461112a0-dc45-49ec-ad5c-999a088adc5d", "comment": "Malware payload (ArkeiStealer)", "value": "8068c55625473ea7b128410c3a2e332b596f69daebc4fcf61efcabceb32ce878", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907544, "uuid": "a708bb2c-dc9b-4601-9beb-c39e2bc2e6b8", "comment": "Malware payload (ArkeiStealer)", "value": "0a48cc6217c280e6a90e05ca3e49faf6de5df720", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907544, "uuid": "8fecfe74-d7d1-4c7b-aa3d-6935a8406d6e", "comment": "Malware payload (ArkeiStealer)", "value": "d8a69e4bcad4f41093b4cc8ac39b5fbf2fc289e0a23a5d82125c968757ebd21fe1c11938c3344f18b4b8f0ad5182736f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907544, "uuid": "109facc5-053f-40bd-8fad-4d7dcf5be576", "value": "T17915AF94F2C390F0EA03267656B3973A1D3166135332CDC7EBD02E6699211E2AA7F35D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907544, "uuid": "6c53ff3e-bf9d-43c0-9f05-c6564f0a55bf", "value": "0a58f944e2714c798ee8060b3352cdae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907544, "uuid": "c2695c64-f2ee-4811-a671-0a5399ab1c44", "value": "12288:qeQDXM9eUoy3WVnWH5RKhqwVp4Wv+NHQ8EeFmvN7ziaFxL4Tb0dEh9FQaLRm2J:4A9bGdSRkqwXVmO8EWm17Wavw0dDH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638907544, "uuid": "c2c1697b-3295-4653-aaee-61037201f55c", "value": 883200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638907544, "uuid": "ba415112-8855-488f-b24d-0050ab2155f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907544, "uuid": "483727ba-0be8-48ff-9a5c-6fee5e23a4fb", "value": "d860635483b145289d8c3d14fe7acd31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92f21bf8-5762-11ec-96a4-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1638884142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884142, "uuid": "bc2cc5ee-ae2f-44ea-82f7-ee71adc5ec5e", "comment": "Malware payload (TrickBot)", "value": "f07891aace9e5507dce8ced4f807f62f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884142, "uuid": "ead18828-43c3-4923-9adf-7785a555d478", "comment": "Malware payload (TrickBot)", "value": "8071e004a26eb2aaac4749720c6b34cebd0f60663fd4522324cdd658df6c456e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884142, "uuid": "74e9f098-4e3a-41c1-964c-5534db87637a", "comment": "Malware payload (TrickBot)", "value": "014eb11f368138759c1138435791317052287826", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884142, "uuid": "26900909-790e-4926-99c1-beaa5d36850e", "comment": "Malware payload (TrickBot)", "value": "d4204030dfbc5fbea0179aca2b146535d774af4bfd50ef18339f55921bff18a43ab735d15e0a93acbd136d2b75fe42ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884142, "uuid": "cd4e2648-87e1-4bc8-94fb-4664d32d17ba", "value": "T1438534041452E27CCA09FCBDC536B49250EF0AA48DA2EC0DED797F901EA16F9D56E6C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884142, "uuid": "2f27f206-2fda-49d8-b693-629070a8ada0", "value": "028cb2120eb61bdd8d53c72736111b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884142, "uuid": "c5d206d1-7fa0-452e-b575-89e330a0b76e", "value": "1536:JPwo+LV1pDpmE/X9XMp2nJ+bNCcMk0RzESN9dFMPiT1akq:9sTDpmK9RJ+8RzBfFMPiT1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638884142, "uuid": "4fd827dd-fdfe-4a84-8da6-9876c452a2a5", "value": 1813504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638884142, "uuid": "9ef6cbe2-0532-4734-b16f-2dd06cbc3c6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884142, "uuid": "73217d7b-1d04-4c64-8242-c29c4adbaf39", "value": "f07891aace9e5507dce8ced4f807f62f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a2fa31d-5747-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638872343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872343, "uuid": "0e3e57ff-cff9-4ba8-b0e1-25891688ac41", "comment": "Malware payload (AgentTesla)", "value": "826fd3667b8e872d369fc387ff0b02cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872343, "uuid": "5c2caf98-835e-481c-b2b2-a41b16d2b60a", "comment": "Malware payload (AgentTesla)", "value": "80dcf1615129a129a73c3a16583c92b21f61b9cb57a30437a2945ceddd72c952", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872343, "uuid": "c13b3f43-0240-4aaa-b879-4a074cb21e3f", "comment": "Malware payload (AgentTesla)", "value": "5a2a6e613c3c4a8fc8c53fb46d3740b82c3c8d7d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872343, "uuid": "eb189a96-f999-4a4e-b710-c1c7ede8482a", "comment": "Malware payload (AgentTesla)", "value": "94b677c66dee7243c8a91d9a1744cfdf4299d3a9ec6b2b105a2bfe9d693638231845f907101cf4a304d99906a24b5176", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638872343, "uuid": "68999b8d-0bdf-44ab-93f1-4566b611b024", "value": "T147353379336C292A0BB6899864594EFFF1105B4D80281963EF2B71DA019BD4F73CF9B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638872343, "uuid": "1ae31ada-0280-45ff-9429-a8b2e9bc8da4", "value": "24576:gdFafTc9poUEz34bTNzxZbloZMlWB+Xm6qM+a8LPBTA5wtpgA:IFec9pqzYxIZMlWB+iM+RTBHtpgA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638872343, "uuid": "31d23070-496d-4c94-a205-c8a740a47d84", "value": 1072291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638872343, "uuid": "0b9537fc-2913-41b8-b623-c96c895dfbf0", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638872343, "uuid": "35dd7871-dd7d-4a79-b301-f939ef09a2ed", "value": "order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52e0df5-574c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638874804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874804, "uuid": "61137ad0-d8ad-4f37-b887-2f0b62cf32c6", "comment": "Malware payload (Mirai)", "value": "ff20fb4dea5261fa3ac0136e2cb3d839", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874804, "uuid": "570cc07e-6103-4ec0-8289-8f65937610a0", "comment": "Malware payload (Mirai)", "value": "81d28f25bdcb93506cb7808da47d979152d34b4b34d20a9f82c89347ddbf8518", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874804, "uuid": "f27355f9-6c5b-4585-839f-b7c8d5119f59", "comment": "Malware payload (Mirai)", "value": "f9187d077224eb202af939da33ae088f9d781dab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874804, "uuid": "e3cbd7d8-3076-485f-bdf2-ffdd78d51071", "comment": "Malware payload (Mirai)", "value": "6e748dc1c0aeae1a6785c18e61cae839ea841887d5d3ab34027ef35f9889c0704dc8ee2ece3182306e4b9f41512a8556", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874804, "uuid": "e863628f-febf-4e0f-beb5-8ba85a17c1c4", "value": "T15D333AC1A743DEF1EC1207B53077EB338B76E47A212AF9C7E7D5A527A845A01920329D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874804, "uuid": "3e988a56-0005-4652-83f6-48cc0314c0bd", "value": "1536:s8OP6OftfvJfrJf0hJeVVMA3Zv78slC8KObYcPnYrTGGgvxU:hOfVxfrJfAJ2VFpwslC8KObRnYrqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638874804, "uuid": "5ac8a2f7-1f79-4887-b017-f033302202f7", "value": 54032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638874804, "uuid": "e9f479b3-6903-44ea-9745-c4ceda8b0f31", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874804, "uuid": "5811f04a-d8c3-41e2-a2fe-22c1249230c8", "value": "Hilix.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d05808-5739-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638866543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866543, "uuid": "7d4db519-94f5-41e3-be93-238d1eb93386", "comment": "Malware payload (AgentTesla)", "value": "f8c2d1df7cbe55e54cc175926c643f4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866543, "uuid": "ce1c03b9-b9eb-450f-95ac-1106ce60cc3b", "comment": "Malware payload (AgentTesla)", "value": "8230e4c683174415110fa0c72d36e1fdb874578ecd61e286acb6e7ca440a1e64", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866543, "uuid": "3c2d5ff0-e993-4dcd-a8cc-ab552ceff4f6", "comment": "Malware payload (AgentTesla)", "value": "45ed2db3c1d07eabfef73b5f325f6116f43c4a22", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866543, "uuid": "f8ff72ec-c345-4b28-b658-10749ff37afe", "comment": "Malware payload (AgentTesla)", "value": "2581a50c02574dab33a710771fc667eb2ef3741c12c163c80a33faa492142a8d4c300e4e1cda0facaa005a77051b5e0e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866543, "uuid": "459edcc7-931a-43f9-8c9f-a4bd240e0750", "value": "T1A13533D8BB637521EA013BD4D5CE04486448F2EDF9723FE3C6B09C1987DA93B61A17A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866543, "uuid": "7c418fe5-7c16-4f06-844d-cebdaabd2cfb", "value": "24576:huyguMtFQMC19fqzKTVZdFX/rkx9M9gXpJAVmUWVhZoTsPx8shH:Au6FQznQgvXwx2QsIgTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638866543, "uuid": "3ef9f158-d5a0-4848-bd7f-7e4028bad31b", "value": 1118097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638866543, "uuid": "161121f3-025d-41ec-b263-467b32b82fad", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866543, "uuid": "a0cd10ba-27a7-4fa7-bc97-c677b0d8b7b3", "value": "Payment Slip_PDF.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c935e9e-57b8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638921014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921014, "uuid": "b2909ab2-cc6e-4375-ba6b-cf0fe41528ac", "comment": "Malware payload (Mirai)", "value": "1002916598ba68acf8ab0a193cb6b3d8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921014, "uuid": "16f1d4ab-cdf3-41c8-b955-3f26710e76b0", "comment": "Malware payload (Mirai)", "value": "8246a01bb98171a47ee73e319d53708b652df997c020518ba9953c7271682fe3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921014, "uuid": "6a0256c4-300b-43ae-8f1d-e9a9fcc292b5", "comment": "Malware payload (Mirai)", "value": "334e4ab1e5fa047d9bc2c7eb27a31d3c96d2151b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921014, "uuid": "6b74bdf5-ac2d-4960-b915-9bd840715db0", "comment": "Malware payload (Mirai)", "value": "d2b2df0adb2af16f27794bf02df6b3f21620599e24d7b85491b25a6824d583bc1bf54edb797350c557a805443df29e89", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921014, "uuid": "42c70fea-195c-4f55-8ec2-bc86333866a6", "value": "T15DD2E0B418EB9832E4B15A71CAE5DEC233030B3DD42BBE35151507E0CE8134F6A7E992", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921014, "uuid": "b0d666b1-c614-4952-a972-975de4670cb3", "value": "768:VXQD3WV1wjry5HfJVih/y79gBqEXzzs3Uozr:GD381bHfWJyZgBPezr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638921014, "uuid": "050e103e-9590-413b-a908-bd71dcbf2ff5", "value": 29852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638921014, "uuid": "4e09c6b9-a605-4075-aa47-476ebb7db10c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921014, "uuid": "4b5e93ed-0639-4389-8af0-f93cf41fe0e9", "value": "trynagetmybinsufucker98575.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "683d6125-5764-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1638884929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884929, "uuid": "747ad814-6886-46fc-8b25-2c9a38deb5c1", "comment": "Malware payload (SnakeKeylogger)", "value": "dbea824e98d7bca868dd9d2f9306a1f4", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884929, "uuid": "ba740600-066f-4731-869d-9450c6a7d8b7", "comment": "Malware payload (SnakeKeylogger)", "value": "826f09866b27658ee783e501ae6bbbb967ea034bedad721973f200fb83bfe853", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884929, "uuid": "e3b590fb-c7a9-4a0e-8fd1-b87e7c3bce92", "comment": "Malware payload (SnakeKeylogger)", "value": "9b9aa4dded0f46dce34d0dddc06afa6321ece81a", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884929, "uuid": "ab45c68c-d0fb-47b9-afdd-2c5f6ac06552", "comment": "Malware payload (SnakeKeylogger)", "value": "8fd43bbf0c98b12f039a8e7002e36dc549a630d7fa61425b55ff1aba08f95bc3e6641d39866e6185e2ff26ff555ecdc3", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884929, "uuid": "5d2b03f1-4b73-4f07-a71a-e8d5b7c7b778", "value": "T1AF13F25F672E585E499270203BA570C3148D55DEE0A11EC0D20E5B3AB3A792777E2EB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884929, "uuid": "2b0ce8eb-f857-4946-b542-171e56e33667", "value": "768:gDBlk5+a6SjSTvd2qG8U9NXBDDsKnFBV7+3X7Hya6hvnqHsaB6r1tUCqtUDhx:045+V82UvBPsKFX7+7Hya6hvqLB2q0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638884929, "uuid": "1e35e173-3bab-433c-8e0b-5411ed889070", "value": 42562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638884929, "uuid": "76ecd6ff-a854-436b-bafb-ccbd029c550f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884929, "uuid": "08f4c767-a719-4fbe-9bcb-e8b671daa1df", "value": "shipment docu.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ecacebf-5747-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638872431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872431, "uuid": "a3f09f6d-0e3e-40ac-a469-5bea187f25bb", "comment": "Malware payload (AgentTesla)", "value": "022f17a9b415da65d3a87d6a7f85a824", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872431, "uuid": "dabff1ff-c38e-4b7c-a7ff-72e7b515095e", "comment": "Malware payload (AgentTesla)", "value": "8275bd18fe28716a0bc10104fcfb46081794044b0b3a6282e29d73e54a4e9abb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872431, "uuid": "d777f85d-f20f-4c3f-b793-72f381f03e6f", "comment": "Malware payload (AgentTesla)", "value": "b55046fc5825ac02ed842539fda2b1db4f6ca9a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872431, "uuid": "6ca84a4a-b3c5-41a8-86e8-bc3af0fc40d8", "comment": "Malware payload (AgentTesla)", "value": "dd7095560089354e847e603c11fbc327e634e92b1b12f9e5153061ec15417a68136bea3aab7ba9ead4f7a45adff41073", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638872431, "uuid": "5eb19e25-baa6-4510-8f2e-3cd15e503a7a", "value": "T1FEE4C02036C7D6E5F87ECA700FB6A2A107B5BDF8D4D0D39EE98831065A73391690917E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638872431, "uuid": "b5ccedc5-6100-44e7-a0a1-17104b88eac8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638872431, "uuid": "1231760f-6674-4093-b483-515a1123c6f1", "value": "12288:RB07a2iNVE1YqeDAGVurtMLIlUqO/S2KN692mRigObdQVYJUEKl75jQWmc:RO7a1Y1YYrWIOqO/S3NUigOb2VYJUEKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638872431, "uuid": "1b599d26-3f59-4cae-b0c2-f7def4ba434a", "value": 714240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638872431, "uuid": "da4826b4-9130-4e41-b220-13a98eabfd1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638872431, "uuid": "1cfddb6e-267b-460c-84d8-791092265c56", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5988704e-575a-11ec-96a4-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1638880610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880610, "uuid": "e8b2b705-b4a4-42cb-98a9-331220dbcb56", "comment": "Malware payload (NanoCore)", "value": "4de38a032d29143223193aca81a5f1ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880610, "uuid": "6fb1605d-3ff0-401d-8f36-9437364b7759", "comment": "Malware payload (NanoCore)", "value": "83bd27006f87805a3d5810343e8582da15ac7b36247b29f83ab7ac09ee2cf85d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880610, "uuid": "59ee3c8f-a891-4a10-a3f5-08dc328c44ac", "comment": "Malware payload (NanoCore)", "value": "d517c0453f530c5f058ee939beda582f90448327", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880610, "uuid": "36d0b1f4-84da-4acb-b3c4-812653e577e3", "comment": "Malware payload (NanoCore)", "value": "749e600f6e1a2aaf74e657e9450f51d64d7cce6e419138198533e6c756617538208464b95f5429dfe37c0534ebe76fca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880610, "uuid": "9b45ee86-2554-4f07-a161-652b4dadce70", "value": "T1F255226D3F87A2CCEDA18674771A503862B53E321027D5CDD69A369F0C63789B633B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880610, "uuid": "21e52136-6387-4d41-99c0-388109ebb736", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880610, "uuid": "8348918b-b6b3-42ff-8cf6-ed61e86c0346", "value": "24576:6KOazD3KzWdQgaO16iCMATjNd20sfBX6TAlgPdHym6u/hgHPYUW:6PaP37valnVT720YX6Tkedx3IPYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638880610, "uuid": "648e1662-9199-40ab-a006-70c1109e3d04", "value": 1404416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638880610, "uuid": "677a1304-b23d-4223-8156-a2f652f935f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880610, "uuid": "82c676f2-87ae-403b-9b6b-b47ed5670fe5", "value": "4de38a032d29143223193aca81a5f1ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab81823-5798-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638907455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907455, "uuid": "b274bf09-08fe-4658-95d8-7f3ac9fada7d", "comment": "Malware payload", "value": "9449f56413ec7de87124f2dbec474db4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907455, "uuid": "53d08730-4fba-4677-a238-420b35e62e13", "comment": "Malware payload", "value": "83cd07ef3456aaef8a61a609d9e2aed4649703cb819872a69f552884a011bedf", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907455, "uuid": "66c5705e-0089-4edf-bd5e-515fefd77523", "comment": "Malware payload", "value": "a187fadcaba8727aee2dc5becfec90759864e8ba", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907455, "uuid": "569c32d1-9c3c-481c-b706-6ac19b602e48", "comment": "Malware payload", "value": "afeef1e0bb06599a6f2492739668294cac2fee1798b1d0cdaf976bfd4f51296937dae3f713e649f8ad3d4885a7b37046", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907455, "uuid": "10b2434b-ebed-4497-91eb-cb4ed5ca43f0", "value": "T133A2B37CD45706A88F81ABF82B1B6F45108CBA6EF3949572327C8BB15BC1D3E511283C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907455, "uuid": "317ce4ee-aa81-4ad7-af85-06df8a8207cc", "value": "384:uYNCjHMUO1QYYBZbkgmR96tv3h1FjM0LuQdAjGjKdhOqIrQHGU:/o8pq2RR9INLojGiHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638907455, "uuid": "36d6bfa0-3c62-45db-9c2e-af89fb7bdc12", "value": 21758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638907455, "uuid": "93d22c20-2a45-4eae-9542-03132a11796c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907455, "uuid": "bf8b2f8e-821e-41a5-b5fb-a271d3bc4a34", "value": "Orden de compra.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1276dfa-57a6-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638913479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638913479, "uuid": "371d340d-31a5-4c1b-af2f-cf78308d79fd", "comment": "Malware payload", "value": "76feebe450a6e666a137d8ceb9f9c825", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638913479, "uuid": "0a335f98-15fe-4b2c-9bd3-cb8ff6680181", "comment": "Malware payload", "value": "84804321901afa7614079efb3e217e6653948cfec47b8815cf23baa7a18b3e55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638913479, "uuid": "dec94997-e69e-4e33-8332-53adc9f1fc84", "comment": "Malware payload", "value": "7504c7112e97810fd548f92acbafe54a79903b28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638913479, "uuid": "aff969d8-a68e-4b7c-a8a3-824fb0e84b26", "comment": "Malware payload", "value": "d416256f1edb0a1a84ce02ad2ffbde75fd23c9c64e2255720de45c1762ac805c8c9046d073315918412e402e538add6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638913479, "uuid": "ca2695c4-3b44-41e4-869e-3b6748e2bec3", "value": "T18994BF01E6E0D034F1F316F89AB9A268A93E7EA15B7490CF52D426EE57745E1EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638913479, "uuid": "3277b6f3-78bd-4749-a67a-95f5511f8b29", "value": "4eb02e1fe9496df33596532c6e671ce9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638913479, "uuid": "4362972b-c0ab-4249-a60a-52d4b9ded7f0", "value": "6144:/JW1WmiRAA+y2nH3eoHnfMnUWNRzk+mO4KDcrjUuf4KkVRzC6BrLL6:/IORAT93TWzzk+x4KDcfUufXkV46B3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638913479, "uuid": "61efe50c-41f5-4544-bee9-02442dd182bc", "value": 431616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638913479, "uuid": "3ec950f8-72e8-4dcb-a9e4-feb95feb72f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638913479, "uuid": "c21d907d-a7d0-4c57-afa0-25c202e33c00", "value": "SecuriteInfo.com.Variant.Ulise.327723.13845.7998", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a42f775b-5730-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638862696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638862696, "uuid": "71165c7d-c4e5-4e76-b284-054430cedb02", "comment": "Malware payload", "value": "02237ff27e198a2ac2378b821046efd8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638862696, "uuid": "cceb8083-0acd-47c2-84bd-b55356f83b58", "comment": "Malware payload", "value": "8500c448e6f953995118b11131f2280d1aebb9a38b4cd5563dc87946fb282c8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638862696, "uuid": "0ffadf0f-bd5c-4f31-8aa4-05c06afd30ee", "comment": "Malware payload", "value": "b753ad53da399f806491586b1debf54dddd6fd34", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638862696, "uuid": "cbe60934-5ed8-4028-848b-17476e6b8f0d", "comment": "Malware payload", "value": "c535f98200033e1a5579d8cdc0aa424ac3487fcbeba5a1c4f6fec56dc0bf3b90a67da10e4ce4adf19745a23038f67252", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638862696, "uuid": "eea630a2-0a57-40d0-8a89-5fbe8c69651e", "value": "T186855D3B2BBE89587082F5265D62EC73780E396ED229F010C18EB517D9B8F7D8264DC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638862696, "uuid": "4aeaf80b-b269-49c7-9107-b6c724bea5e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638862696, "uuid": "3cda95e3-6926-4958-82b2-ea0481b76e2f", "value": "6144:Uslz/ONVqe0Z0StxFafDYcP303ny+RiBKAwYYgRmj:TACT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638862696, "uuid": "8ee763be-c4d0-4606-8284-4b0168936b77", "value": 1830912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638862696, "uuid": "a6ea9c20-08f3-4246-8426-dfc894ba3f97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638862696, "uuid": "3732d325-f64a-4210-880b-85865018fa0e", "value": "02237ff27e198a2ac2378b821046efd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e4d978-573f-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638869219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869219, "uuid": "ce2c3cad-b66b-4438-88d6-694de34d198a", "comment": "Malware payload (AgentTesla)", "value": "f10b59b1badb6412aa11859214391a04", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869219, "uuid": "8194c2e9-989a-4431-b0b9-406f3bd637b0", "comment": "Malware payload (AgentTesla)", "value": "85ffa829fa1f30fadc46ce45c43b9a69b37fccd650bcbfab8a86d76f4c57732d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869219, "uuid": "4fcaad64-1a2c-4376-8422-bfe1a524496d", "comment": "Malware payload (AgentTesla)", "value": "05df183a1eb6d6941e6c4bf6acc998aeadc4f471", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869219, "uuid": "2a6761a9-344b-47ca-bfbe-0642fb14059c", "comment": "Malware payload (AgentTesla)", "value": "b6e1dea5b8ccb5654626f5c84401d2639793ab9196b728c8094ee10a75441203e136f1349e4612c80c352edcfb51a2d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869219, "uuid": "dcb42b76-a80b-4419-bbe3-a07435fb7c62", "value": "T1018412E1455C91FAE9270BB04656CA2A2EBE7FCAE650E223755FF05B4E773C0B02050B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869219, "uuid": "4b48a879-73b8-4cb4-94ce-1a6ed1eaad54", "value": "6144:SJnlNlvwvo+6bWY0QB5N1ArKE5jbXz1nEwoOdZ/lBFjCD:qnnlvwv6agVmrFDZnCyL7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638869219, "uuid": "2c6d1ead-d1d2-4b14-87a1-566337f491c3", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638869219, "uuid": "aa76388f-2440-4e19-97c1-6605bffeb99e", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869219, "uuid": "2e815b67-1ffa-4baa-a101-765b21d5f6bb", "value": "SWIFT 09372-97308qdf.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c320a829-5751-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638876921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876921, "uuid": "fb915449-ea52-4124-95d3-5bc28f4ab838", "comment": "Malware payload (Formbook)", "value": "f27eca531a901fbd8ab9cfc96cc22ee4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876921, "uuid": "d3eaaeda-ba6e-45c3-9166-5d0e3f29ad09", "comment": "Malware payload (Formbook)", "value": "868c1568e17bfc2dde5345e275d6a834778da74b12e603f69f3832ed32416769", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876921, "uuid": "bc49cd34-7513-4ea0-b518-f6c18e2cb4df", "comment": "Malware payload (Formbook)", "value": "41abf66b0de9088313781a0a12271c0c883aee70", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876921, "uuid": "c01e8f86-9fd2-4087-b7e0-b8c2eb18d5d4", "comment": "Malware payload (Formbook)", "value": "88928e78d7975ce33882c859caad03bf54110658e7b3edb6cb883f36813602add1d41928be2d1aa68dfae64b0e177e6e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876921, "uuid": "e63e84d7-a077-4267-856e-aacc62568743", "value": "T1C334123935AC5F0EF1DEAE708A9884205335FDA5E48253F7963EF65943F8AC85C82241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876921, "uuid": "0a0eb850-2c61-4768-8028-65ce3d22bf1f", "value": "3072:HPna6JEthAUpb9BkCGVAKV86OP3xLwV5zLKsfbCCz3RsXTHF7HfNFGJ0HfZRtn42:y6qk4Qz2KdOJFsj3RsjHFhQ0HfZ7PDjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638876921, "uuid": "e2c44e8a-9787-4104-85d9-dcca0b704b39", "value": 234824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638876921, "uuid": "25a9426e-8c66-4bbc-a5f2-ada536d41cf9", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876921, "uuid": "1122eefa-ff35-49ec-9662-054344b1056e", "value": "3005.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33557551-5722-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638856494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856494, "uuid": "50baf6f3-8eb2-4cbd-ac6b-5f2f83a68ecf", "comment": "Malware payload (Heodo)", "value": "fdd7ed15419d7bbc6e6594e14440cbad", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856494, "uuid": "bee5861d-b165-4533-8425-51a05b7fc611", "comment": "Malware payload (Heodo)", "value": "86e693c80abca647be215e202f19864de0c46b37f02dfcb64ead0485ab18400e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856494, "uuid": "a0269f71-07e6-482c-a9c4-140a87a3d5fe", "comment": "Malware payload (Heodo)", "value": "4b37d28279a0857e148e38a877151fbf93ed8d1d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856494, "uuid": "513426df-45d8-4d15-96fd-231f008ccbf0", "comment": "Malware payload (Heodo)", "value": "efed449453adbf56a4b9fe185714c153a2c18b72b8559f82c2546d1ff68df2b8a3be1fa2f88b240d4be791786c590906", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856494, "uuid": "b35c76a9-0c17-4ab4-a7c7-b434bb5e3494", "value": "T152F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856494, "uuid": "5d1967ea-59d2-469f-9e4d-945595ea5a34", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856494, "uuid": "fe2b6072-77e1-48ce-b4e9-f3bd3cea2715", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/y:JapiKiBEmj4GbOX399Md9J/0Tw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638856494, "uuid": "f828ad96-8767-4ff7-ae4f-7cb0f453586f", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638856494, "uuid": "90660f24-f297-4631-b891-92d1a031cf1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856494, "uuid": "1969b43b-6a19-44a5-837b-41435d1fe0f6", "value": "fdd7ed15419d7bbc6e6594e14440cbad.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4bf9378-5743-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638870992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638870992, "uuid": "2f040b98-e7a3-41a7-80c1-02eae187034f", "comment": "Malware payload", "value": "640268f810eb85d021972befae02489a", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638870992, "uuid": "2e769b40-51c7-4323-8fc6-d25023f6b1c1", "comment": "Malware payload", "value": "87b2226ae59fc95b77f0e45b55c00249be90ffdca065c95160f9ef01449d92fe", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638870992, "uuid": "fb69ff9d-6a82-41a5-bd8b-3b1eb4f46aef", "comment": "Malware payload", "value": "d265d1fd8f9e27869679b42ab847ce4955c81207", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638870992, "uuid": "9967873b-5257-4195-a0cc-44d41f0122ee", "comment": "Malware payload", "value": "2c28f749ea7304b2f174cba3427592cff4975cd865978bbe440d073356659e934eea1d07d7f2f21c44d20125834a4c97", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638870992, "uuid": "1b67b964-2cdc-4856-8e82-25c54c2e2040", "value": "T1CAF5330C53AEB8FDF89946293B6348A0C5E852F1988261F2D77C19980C3F57D1B9FA21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638870992, "uuid": "83c6aae0-2b01-4044-b7be-3e42aa3994b6", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXt:0XSxVJG2fLAqFOfT9sMYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638870992, "uuid": "fcac87fb-2fb8-4669-a730-008d6737b017", "value": 3338240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638870992, "uuid": "547f878d-be51-4d14-90af-0b2e3fcc0200", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638870992, "uuid": "a77531c5-9f44-4a4a-9db9-2bf6b8c7b174", "value": "87b2226ae59fc95b77f0e45b55c00249be90ffdca065c95160f9ef01449d92fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d1cc00d-5797-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638906815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638906815, "uuid": "1806cb3b-96f0-4a76-903f-0be286ab0f79", "comment": "Malware payload (RedLineStealer)", "value": "e71eb88b701c0cef07342be1c3ad3e14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638906815, "uuid": "da032813-cb30-4ff2-a2ab-87493d1fec24", "comment": "Malware payload (RedLineStealer)", "value": "87f7330e0b6da5f050d9f8e733ab76f049e91985e62d14707643e0a62246c42b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638906815, "uuid": "7c94beb5-8544-48a0-9a7a-f0d1d81af995", "comment": "Malware payload (RedLineStealer)", "value": "b8a70dfbd596a50b46f87c1a79e31ce958f8dd03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638906815, "uuid": "b3b1561f-89e5-4ce5-b84f-b181618a2df5", "comment": "Malware payload (RedLineStealer)", "value": "e643901354e957a309a0b0b0689ebf0c939af8a08cb15fb4027ea3df9e958342ac4a8e84d340b9a050788092259293bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638906815, "uuid": "ec6e0749-ab19-4ca5-8893-30af155beed6", "value": "T1FC65331AC5887BC2C71C9BB829F71E0A40DBC777B952324125655E27170C0B8FB5A9DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638906815, "uuid": "bb90bace-7153-4c8d-ba8e-dbc0e98de032", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638906815, "uuid": "7b8c8334-6d26-4267-bee0-7ad66586eacb", "value": "24576:0rsgFhRPP0Ozex9Phwiv9+IaThnXmMc8TPTdtV78yec5dRkEaHNYK3W1ZOeQqs:0lJMOixVGilLaGOPTdtF5V5dRNaiPQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638906815, "uuid": "8a0ad49b-84d4-49d4-a88e-730cc64e9c83", "value": 1482240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638906815, "uuid": "c0bcb58f-2fba-49d4-845e-bd8111022d08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638906815, "uuid": "24d70f47-0db8-4750-93d4-17faeb26ada2", "value": "e71eb88b701c0cef07342be1c3ad3e14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efbc1a63-5747-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638872701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872701, "uuid": "218f6123-ff83-4133-bbea-4fe2fc07f145", "comment": "Malware payload (Formbook)", "value": "f8518c8f5bc7388ae11611fc8216ef98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872701, "uuid": "eacb7926-4240-4ecc-99a0-4dc1c66e1c77", "comment": "Malware payload (Formbook)", "value": "880d9d46e74d9f2a0c870d561b9f310478e507376a2b0091983c81800ac92906", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872701, "uuid": "c9605716-2dfc-4a92-856a-a05334c95375", "comment": "Malware payload (Formbook)", "value": "b0618781ad06e5cc019cd3669755a33959900f6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872701, "uuid": "8aa0095e-ffa0-44c8-8c72-44e49b1b1d05", "comment": "Malware payload (Formbook)", "value": "17f75c25770478f06bba8c76510ef155ad3cf39306800519c5921cdf7a112b75547d0116a9f3bd87d25736d3973e42b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638872701, "uuid": "fe8d2710-2386-4f0d-abe7-744b15d1088c", "value": "T109A4D083A98086F6EEAA5F31A03B8D25175B7D7DE974A41D25CD78641BF3CB30036D22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638872701, "uuid": "69e011a2-aa5e-41cf-8a85-7e9e0ce1c104", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638872701, "uuid": "9b6b5547-551b-4081-9ca9-80deb7f50fd1", "value": "12288:3drXAN06YgLLLLLLhLLLLLLLLLLLLLLL6LLLLLLLLLLLLLLLxLLLLLLLLLLLLLL3:trXdgLLLLLLhLLLLLLLLLLLLLLL6LLL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638872701, "uuid": "bd24451b-51af-4da9-bc57-1d285765c50d", "value": 488907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638872701, "uuid": "63d4f9d3-30ee-40d6-b20e-cd4b64e5ce8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638872701, "uuid": "7993b425-45a8-4b32-8cdc-c2ce31d71e96", "value": "Salary Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b2dae5-5723-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638856880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856880, "uuid": "d7b54ad6-0201-4eaf-8386-dbbd1bf19907", "comment": "Malware payload (Heodo)", "value": "e0ca2a5edc6fae30939bbac4e4e7d72b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856880, "uuid": "ba8d3103-2374-4d00-b1a4-97ca39110f7f", "comment": "Malware payload (Heodo)", "value": "883b5d8f94884725066e499493fa425b1f29f4f2bb0d333dc8e669a9c32f50ea", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856880, "uuid": "9b858078-6cf3-43b2-a310-cbb208f3b6ba", "comment": "Malware payload (Heodo)", "value": "108eda6f11962f66a0623c5af4564b084c82d532", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856880, "uuid": "6225be3d-59c2-4115-9a0a-cba725bae032", "comment": "Malware payload (Heodo)", "value": "f24bb749fe162b7e4e25e4dd1a0953a50fd5dce802b611cbfbb0e395607f62489df694f701f6647c55a4d085f1f874a3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856880, "uuid": "7f13fdf6-fac3-4bc2-8007-3d0e28c774de", "value": "T1BC544A00F251A139E9E710FBC6FB48BD99AD9B00134829CBD2C96DE5E7564D43D32A2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856880, "uuid": "9f952feb-3071-4280-93a1-a1fbe0d6fc1d", "value": "6144:m09MHnGC7LRzxzVZYsuOa31UvQV8yMcSWUMuEpzQDWyGVWHmw2MnvXkL:me+n9DJGtOal5V8yMcztuEpzZ4GbOXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638856880, "uuid": "905f82da-3e41-4105-ab57-b48325c3813d", "value": 294448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638856880, "uuid": "75febdd1-ed89-433c-91e1-fdfa7fa342bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856880, "uuid": "edd672bb-bd40-4d14-ba9b-4d32b4031f3c", "value": "emotet_exe_e5_883b5d8f94884725066e499493fa425b1f29f4f2bb0d333dc8e669a9c32f50ea_2021-12-07__060116.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b9bb89-5735-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638864683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864683, "uuid": "309b1e64-8806-4ba5-94c0-431ad7fba3a2", "comment": "Malware payload (Heodo)", "value": "5d4b923d1c6f618150c48938f4454cb8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864683, "uuid": "d2fb4385-a00f-45af-9330-3ec502d60d61", "comment": "Malware payload (Heodo)", "value": "88515bfa35272ac1f8aeadeda5562c4146d9194c8e18bcff098814ae47b44269", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864683, "uuid": "1227bc47-2dad-48f0-be78-7951962e3dc7", "comment": "Malware payload (Heodo)", "value": "cd44a2fb1651fae09062e8b2169101162fde9ec5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864683, "uuid": "bf690820-ea91-4afa-b855-30fb76f08d5b", "comment": "Malware payload (Heodo)", "value": "d556ee622542ebaa6f9fe5dcbfb7103ac43863dffbe899511dce15e46a6b666948f757ff7d7f1e2ea031438d074b010b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864683, "uuid": "57803d3c-990e-4369-b6f5-e6a348172b07", "value": "T178F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864683, "uuid": "71db32fb-a1c4-41ae-b58b-6f57c2c8a6f2", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864683, "uuid": "3a347479-5788-48f3-8833-facb40dcdf94", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/9:JapiKiBEmj4GbOX399Md9J/0Tr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638864683, "uuid": "1812ebfb-e67a-45b6-9109-b1a81e0bec4a", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638864683, "uuid": "99777ba8-a964-41be-8644-39e2503c0dc9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864683, "uuid": "27b60ef6-b426-498a-b7d7-4ea44c32fda2", "value": "5d4b923d1c6f618150c48938f4454cb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18eaaf63-5775-11ec-96a4-42010a9c0029", "comment": "Malware payload (SystemBC)", "timestamp": 1638892098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892098, "uuid": "0cd59e5f-bea4-4b9d-8a14-fc470f699629", "comment": "Malware payload (SystemBC)", "value": "345eaa8379ef8daed16ebc210e7c0165", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892098, "uuid": "adf8105a-5b5c-4cca-ac00-dd04ea41893b", "comment": "Malware payload (SystemBC)", "value": "88e66423a3a96f03441102060b775e35d0e401a3e4f74e1c3e54f9bfdcd06258", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892098, "uuid": "521f3c14-2968-49ba-8c2d-93b52aab2bcf", "comment": "Malware payload (SystemBC)", "value": "c9278fe7bf96f97556527782f271a554a8b73a68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892098, "uuid": "183f81ad-e52f-47b4-a79e-5224698cdad2", "comment": "Malware payload (SystemBC)", "value": "a2a770ea4730e69605cd4347c52bd91fd0b0fddc629c6ce30838ba883c442c9371013bc5fcf5a44520b939b0860ae631", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892098, "uuid": "6f6bff90-0c0f-4770-b361-10f5c708eadb", "value": "T17B648E10A6A0D435F1B712F85AB9A369B93F7EE16B2490CF52D417EE56346E1EC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892098, "uuid": "0fda23b2-1e55-461f-a9a9-2137e1c43748", "value": "b5d39f822cf46cb1cac0e9a27db40014", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892098, "uuid": "745746ff-414c-4033-a048-51b593706a26", "value": "6144:okXvlvO4W2rop49UNU1Cz70xu5sQWvCY1hPE1JSNq:okXo4669UN0Cz70xqsQWF1he", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638892098, "uuid": "c74e20f3-b8ef-48f9-95d7-14f949b2b556", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638892098, "uuid": "f8b34dc1-1bba-4e3b-8ecc-1562fa38853a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892098, "uuid": "99d5c324-def9-4e30-8f0c-273116340abb", "value": "345eaa8379ef8daed16ebc210e7c0165.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f8d23e0-5757-11ec-96a4-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1638879412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879412, "uuid": "d188bb7b-f5c2-4dca-8369-b5f1e765b9a3", "comment": "Malware payload (DCRat)", "value": "06b365b60c9a26c1a14a1a0ceb1b5dd3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879412, "uuid": "09c64e9c-e48e-4c21-92ac-cfe13b1cb67d", "comment": "Malware payload (DCRat)", "value": "89c0be5d91e295961fa17f774c23b0b9cd963c9183de5818b3e699165a08a826", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879412, "uuid": "0450b6bf-16aa-47c6-be86-2db03129eced", "comment": "Malware payload (DCRat)", "value": "0c6ad2c99dc73417b9561902415bef93586ae349", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879412, "uuid": "a31e9dc5-3d05-48d8-8a04-9e080a1effb9", "comment": "Malware payload (DCRat)", "value": "d7defa23e99e118519d44e608c698bf925e06c1ac316b1e2735748bac6bac0959b5fb2785a6c5107fc62c2d2cb7c2223", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879412, "uuid": "1c48726e-f765-4542-bb14-7dd679e623b5", "value": "T105636A023B948D25E1BD46B97CF2464105F2E2576027DADF3CC400DE6BAFBC989527EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879412, "uuid": "f7101a5c-3657-47d5-98bf-e183827fa8f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879412, "uuid": "7c9a9ffd-433b-4f4f-aa87-499d895ca79a", "value": "1536:V/YO08RSz/oPrVJEbbf79pog8EgDStpqKmY7:ZlRpr3EbbfLog8EH2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638879412, "uuid": "215db06a-8086-46f1-b969-15318e4fbe8c", "value": 68608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638879412, "uuid": "7a699996-fa34-4e2c-8131-971ab7a48bc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879412, "uuid": "f8852f9b-b59b-47df-9969-31401ac1ca60", "value": "06b365b60c9a26c1a14a1a0ceb1b5dd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ff4022-5798-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638907471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907471, "uuid": "f9257340-e6b4-4751-836c-2de015908fec", "comment": "Malware payload (Formbook)", "value": "cacad265519e30042811c7a30dcda471", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907471, "uuid": "f97e5f91-53fb-439e-968b-6001f48f0952", "comment": "Malware payload (Formbook)", "value": "89f4f79ac4d11f9d5edc1db5526dbc6705c528b3a48d7c103906be084bf91b23", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907471, "uuid": "758b5ca2-84f9-4223-8058-d6021eb9ae55", "comment": "Malware payload (Formbook)", "value": "b82bafb6fbf9d10439bdfa9282df77aa6bfc9fdc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907471, "uuid": "5714b083-b485-4fa7-ae47-540f44162fb0", "comment": "Malware payload (Formbook)", "value": "c428c0d0a061197a4cc0245effc1db34ce08abea94712f9f9d5d70222474a344288b73689ca45cba022712cb7178049e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907471, "uuid": "f5c12acb-7652-4ddd-96b6-87ff0a7f72e9", "value": "T12D341201F6D46939E15D1F36E18BC9AC8FF8DC276B53E9014CAE339D94B75020A24ADE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907471, "uuid": "d6d2ffd3-107c-4056-9de7-099f13143cc7", "value": "6144:mZKUNag+hz2FEhkF+3ShKbbsjR7D2Z+n0VaLf0Bf:mss+c4dizR7D2WoaL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638907471, "uuid": "d6dad3f7-d6f6-4ffa-bb0e-0fa68df69a36", "value": 234584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638907471, "uuid": "4885b7f5-dd88-4800-b675-3c5ebbae4ba5", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907471, "uuid": "2ebcde3b-ed58-40a4-a744-d1b6bb8c5fd6", "value": "3006.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa9b4e88-5770-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638890329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890329, "uuid": "3e5da5c3-f497-44d5-893f-d3eaf678ef6a", "comment": "Malware payload (Dridex)", "value": "1909b272d9181868d904bd61217e70d6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890329, "uuid": "1fff3435-c23e-46d5-a84d-5ddb569c7a9a", "comment": "Malware payload (Dridex)", "value": "8a2b0fe07c437a225d7457891b09f617cccb9dc84c237d7c1ff34a913eeda804", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890329, "uuid": "a9caa23e-e51c-4bfc-bf94-6cb762579b79", "comment": "Malware payload (Dridex)", "value": "befff61f7812a7e6cbdf4c72fcf3703c62f49992", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890329, "uuid": "ff660135-0b02-4544-bd58-0891adeafeeb", "comment": "Malware payload (Dridex)", "value": "b47c56f8d33cf67fadc8c44587ead6649b7a56eb4f1897525096b8bb89eb5fa0bb44d3d7626fc8e8489fb8f8dba04a6b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890329, "uuid": "7660ac04-994a-4110-aabe-5245412d6884", "value": "T1DDC30862BFAF6CF6C605B7BBCA9615E0D3F2DC17122A92FA1544B32D1E306D14D4D822", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890329, "uuid": "b346e04b-4ce2-493b-b9bb-d7e767d6d2ee", "value": "3072:0k96FE76hr0dOAn98AdwL3x2bVyE/KC7AZ5uPON1SNreH2YRMHZ1xs:F96FE76hr0d3n98AdwL3x2bVyyKC7AZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638890329, "uuid": "f63b8869-697b-4528-9410-7b04f7629a94", "value": 128000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638890329, "uuid": "8cd15aac-34d6-42c3-9c90-b9255bd6d01b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890329, "uuid": "7d702add-fedb-4695-80e8-57ab8bbb2c8c", "value": "SecuriteInfo.com.Heur.21578.29033", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a63111-5737-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638865625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638865625, "uuid": "70c068d5-347f-448d-aaff-ceb4c2aaee6a", "comment": "Malware payload (Formbook)", "value": "5b17aa4c795a5eb4da3d4b77fda3051b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638865625, "uuid": "c403785b-c259-4534-ad58-e90a630df237", "comment": "Malware payload (Formbook)", "value": "8a7a6b61fbbf494613436cfed3e686c9504f6d36489d67dccb1e050bc262c93a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638865625, "uuid": "fd03d62e-17c6-4801-8c24-574d787c9a72", "comment": "Malware payload (Formbook)", "value": "ca6c715c26398d9ba77375194840beef0574c76b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638865625, "uuid": "8a4704b2-a238-44f0-a813-fd44a61f6f72", "comment": "Malware payload (Formbook)", "value": "8fb403d801e11ef7029da857eef27cbbef3f4b479349b8a3c7e739f4e62a5f5979cc03abf761910f940262b26877b372", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638865625, "uuid": "6ae84667-7b68-44f0-a661-e6839002caab", "value": "T11F841257D0C403F7D5AC4C324066EE3B67B6F1530274670A8BEA9E6A69A5403CB1FB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638865625, "uuid": "6b3f03f9-2838-408a-9663-5d15da689c50", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638865625, "uuid": "93dc1e62-4317-4ae1-b22f-380b02e558c5", "value": "6144:jGi+BQAJ6i/nj53Ak48oeF1LuQx0fnNBFz1D/8teBRIelmsol/DMrZA3Zu2nP/Bw:3Y6g53AHyEQx6B1XIG4hMraBP/BrtDL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638865625, "uuid": "50768e1e-a5cf-46a8-b1eb-f60f318c8bc1", "value": 382558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638865625, "uuid": "d479c49d-d14a-4707-a50b-5245a3c7c25b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638865625, "uuid": "b9bba587-4026-4976-a54b-e6c01688709e", "value": "lordisgood2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0729ee-57a3-11ec-96a4-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1638912018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912018, "uuid": "683e7db8-5172-4c40-8cb5-06a9dfe99d86", "comment": "Malware payload (TrickBot)", "value": "23f98d6ff7329618994ac0f3e2b3a394", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912018, "uuid": "1157ed76-bcdb-4814-8975-5955b6f154fe", "comment": "Malware payload (TrickBot)", "value": "8ae73acc01f72c1164324e44045cd74256c3b4be606c0932717a2b593e8c5169", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912018, "uuid": "cc62fbb8-0253-48dc-8a2f-afde04a0e60d", "comment": "Malware payload (TrickBot)", "value": "64ae82d4c4d66d2703e8e310e176808f380f727d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912018, "uuid": "77a9b7dc-5b8b-42c5-9842-0601aee92ab7", "comment": "Malware payload (TrickBot)", "value": "d10f1c921c49a2d85dca0be46354726f6d41aa0e6b5a6465fb554fb39ae88166f1e381c8d2f4bae22ab187c0750b1a99", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912018, "uuid": "a1795957-73dd-46c5-b106-762a6cf0f39a", "value": "T17BB4B0F4A073D554FC1F26B6A5C128884AC73DEB3A1EDF4A0128B57F29754D83AA484F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912018, "uuid": "014033a7-79f0-4d75-90c3-e2c076b5c77c", "value": "3072:AE1bLoyHKRH01H+N6NODxksdh31wLhrQ37GJka:A4/pHoHyeN6NQph31JGJk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638912018, "uuid": "db26de89-5a04-43d8-8102-8a53874c174e", "value": 513024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638912018, "uuid": "fc3f985c-86ac-48d2-8b37-8030d4d801e2", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912018, "uuid": "be48085a-6e4a-43d5-b63c-f581bbadc772", "value": "1bmd.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d64c076-5750-11ec-96a4-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1638876241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876241, "uuid": "a8a1f595-99c6-40f5-a236-8c3c03a8b572", "comment": "Malware payload (NanoCore)", "value": "73b659f90dabf780159e04b90d1d47f0", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876241, "uuid": "01fbfe48-4d31-4727-9b2d-8bd89c5fbeb2", "comment": "Malware payload (NanoCore)", "value": "8aedc06a74af84cc7fb076bbfff413727c301950c53f822b8d1d285bf295fcf6", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876241, "uuid": "081106c8-b400-4913-bf55-ad5a3f74d852", "comment": "Malware payload (NanoCore)", "value": "3faff954db0ebe7fe6ccaf10214754f63339fe36", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876241, "uuid": "302d7558-e1c9-4505-a3b0-dcd20eaf1423", "comment": "Malware payload (NanoCore)", "value": "181862690d1cc31eab9765f5b65f3ffed145aaf160e1d0bd2b463f9c708d312cac7df8529dd4b8e086653d660ba8edd8", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876241, "uuid": "f086a2cd-d980-4ed2-8960-2c9a6aa179d0", "value": "T1EA341248F65F0921DEEDE7F8017121FA047EEDA15E7E50AB40ED7B8BB139150CB2891A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876241, "uuid": "a111620e-463b-4b91-aef7-7f2f6e8311b0", "value": "3072:OGjkLHG9BLUgO/O1Z9h+rQMk3PcfGutbvjb5zXMhhJwpIKRD2b/7zdCCIU5qmzv4:OGjMCBNayEdk/cf1dXMwpIc2LuyqmMtH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638876241, "uuid": "0ab1fb17-abb3-4d7f-ac41-48cadff80d2b", "value": 234984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638876241, "uuid": "098131b1-fabc-4e5e-a694-bfdbb5cfcf60", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876241, "uuid": "6f0036ec-9a31-4fac-817f-940ea7e4acd3", "value": "Telex Release.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30cd6fca-5772-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1638890849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890849, "uuid": "8d924656-b683-408c-b6dd-1fbfc24014a6", "comment": "Malware payload (Smoke Loader)", "value": "f369fcbe630e461a8ba482db48f0dbbf", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890849, "uuid": "f377309b-4450-49bc-afaf-9f31d2034d0d", "comment": "Malware payload (Smoke Loader)", "value": "8b01dbcf5224873f79aa338e6f50c3cfefc41a1345d9eb5e4a5566f5a190586a", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890849, "uuid": "9506fd31-2462-4bbf-b50b-da71b98bdcac", "comment": "Malware payload (Smoke Loader)", "value": "6c0e71df40a976c484e20711e9f97abcf2cb4240", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890849, "uuid": "472c7a7f-9a86-4f1c-9049-3de27e232a4c", "comment": "Malware payload (Smoke Loader)", "value": "5724330b96efc1e5c7c340061dbfb4fdedc90c3e6b0ebfe770b7dce39fceb83d68f2fb6e1f97640831ef989ed1d6eba7", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890849, "uuid": "f3a1d866-0184-4ca5-b1f5-77d76fe35045", "value": "T140648D10A6E0D435F5B712F45ABAA379B53F7EA16B3490CF52D416EA1634AE0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890849, "uuid": "f9d8d321-e911-4269-95ae-e6a7c6bb095e", "value": "bd61429d86f194f3b84d97af55b8c371", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890849, "uuid": "5437f6ae-6197-4c1f-bac3-4c648a4c4660", "value": "6144:NLLwqlqixJuKG/kn/yrArPCUy1u29oKVSzxr6CoqyUbAV+B:NLEqzJuKGcn/yErPC31u29oOSzxnoabA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638890849, "uuid": "829a4add-9371-4225-8b6e-4358cd393e53", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638890849, "uuid": "b1353b94-a86d-4eb2-9595-53d326b0de6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890849, "uuid": "ed45fb35-cd87-4947-b239-c356c683de67", "value": "f369fcbe630e461a8ba482db48f0dbbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45b1e70-5757-11ec-96a4-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1638879447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879447, "uuid": "041cb944-3849-47ce-adff-f6be6e1e2c08", "comment": "Malware payload (TrickBot)", "value": "5880f8b6115f5e8ae3faf01920d38dc7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879447, "uuid": "1ac8b584-34b0-4235-8f8d-e9f50fb0b1bd", "comment": "Malware payload (TrickBot)", "value": "8bcfddc163b1eab5905425101e6af899c9ece1d64b9ad19ff58e6fa00f828ee5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879447, "uuid": "199acf06-1b3e-4886-ab9d-3c9e6194882a", "comment": "Malware payload (TrickBot)", "value": "760a4b58b4afb8a8a5b69ea350e5d1941ec83be6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879447, "uuid": "1a927b30-82a8-4fe0-992f-988962251dd6", "comment": "Malware payload (TrickBot)", "value": "acba1657a26cc00285486dabc31b1173b580df17ba8b833f0c5db57c3d281a25f21d83d06a952f8ce33fa4b815109607", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879447, "uuid": "ef84f542-6d46-40fb-8eea-d9ddd6932265", "value": "T1E4852045E333E26F081E1D5F24A0284DBCD45D5EDDEAC675B96E3B097030AA929843FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879447, "uuid": "db38ffd9-9326-4689-a1d0-086b4efe537c", "value": "e75eb1a5e0f6a6f270d53cf83abadcb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879447, "uuid": "e1f91185-911b-49c2-84aa-35550747c921", "value": "3072:zl2lguPevfGuVqnpADmSRyXXp+VQFAAP+fKh6t:R2lguPIf3VAADNcXp+V4HP0Kh6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638879447, "uuid": "964e36d4-c7a4-48d2-92b8-9e89d0c89b87", "value": 1865728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638879447, "uuid": "c84c7474-0f5f-436f-aafb-5bd0f7d2e632", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879447, "uuid": "def69dbb-4954-4314-8062-6196d86ebb49", "value": "roben.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "473f1390-577e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638896041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638896041, "uuid": "7e34e11c-93b0-4e63-9197-4696d58bf54e", "comment": "Malware payload (Heodo)", "value": "09982e610e61b678116e58d70ca4bb3b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638896041, "uuid": "2179424f-3aa4-4fdd-b4b6-960ad6e4402e", "comment": "Malware payload (Heodo)", "value": "8bf58824029b9cb9b7aba7748da8a2f95aafedf5789bcedc98e79d5040b42026", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638896041, "uuid": "a8cf873e-7923-4279-a5d9-45ac025709aa", "comment": "Malware payload (Heodo)", "value": "52a99d8c3589aa066baf064f52d28a947a454e40", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638896041, "uuid": "626aa801-d226-4da0-b134-56ae70f04ac5", "comment": "Malware payload (Heodo)", "value": "ce15330208186b2a7e0624387cbea44c01b91c7b763fbf3326d3a9bd75514d806a10938f1dcd8570c0d3c136e51bdc36", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638896041, "uuid": "5b0d0043-74bd-4679-9819-301443a6ad7c", "value": "T16924D0B171808539FEBF66385D34D1845BAEBD90CB21ACEF7604019B9A685C08F73D7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638896041, "uuid": "fa02ded8-2f80-4de7-a10a-b6b5a83958ae", "value": "35dc3f1eb8a03291fc0dc93396a967d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638896041, "uuid": "7f7ce3d1-4ebd-4e1d-89dc-b14a191dbc97", "value": "3072:MCDoXOpFVtI8/7gsEKr8x7tiUabb1mVDtcQhdYJBoo31kCsIN7Giz+w/gnViasLI:MGoX+VtZ/7vEKrWpwobOWo39sjC/Wss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638896041, "uuid": "98e3a4c3-9c87-4a2f-83c7-d38f9c7a0044", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638896041, "uuid": "516dcf87-dd83-4b94-b619-1ebc289d2e3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638896041, "uuid": "80b8901e-5ba8-41c9-949c-74e1fb4c4ecf", "value": "09982e610e61b678116e58d70ca4bb3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3113c69c-573d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638868086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868086, "uuid": "e96d9975-3286-4703-808d-c2abadd87325", "comment": "Malware payload (Formbook)", "value": "9b2acc245f97613803c7ae319820e210", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868086, "uuid": "9acc8a18-d0bc-4023-b983-b1f32c6a2581", "comment": "Malware payload (Formbook)", "value": "8c9742ef470d7775d50747b430a247f90d491597395989269c2e42d640baa2df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868086, "uuid": "fbbb0c66-8eff-47c4-a15c-a47c100b1d40", "comment": "Malware payload (Formbook)", "value": "c4ce99ddecfabddfe9fbb0916facf2d428c1d176", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868086, "uuid": "94938c59-7151-4604-997c-ffb8e0895279", "comment": "Malware payload (Formbook)", "value": "7d5e16b48fc167b7a297a3150bd8d8a8f81502dea8a806a50782149aff774452d8c50e927796b45349d8c1a8efe7d52b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638868086, "uuid": "2d3704ed-a618-46c5-a8cd-c7f8c2d77d7f", "value": "T181555A5C317024AFE83A853145541F379EF12C7D966B93CE731734AB8ABE9428F242E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638868086, "uuid": "ce64d477-0585-4d88-a4ab-3ad20a972628", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638868086, "uuid": "50fe5c13-5bab-4c4f-bee7-9bc983a7fbfa", "value": "24576:SPJgiLBr2Nl/E7oupiRfu1MSmWmTXa9YNs/gBgVFDRrLe:sJgiLUNls8YiR21fm9TK9YNso6Vz3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638868086, "uuid": "3d82b10b-92ba-4e78-8b0b-c49ba8e76652", "value": 1338880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638868086, "uuid": "184dbaa6-39a1-4e18-9bcb-10e7e9264808", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638868086, "uuid": "b79eed04-b795-4672-88e0-6e549b9303a2", "value": "slip-12-6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff0075e-5756-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638879010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879010, "uuid": "a8b608f1-79fc-4825-a34c-66698cb6e9f9", "comment": "Malware payload (Mirai)", "value": "4bdabe6841030c3781df27409813cb19", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879010, "uuid": "4086ad97-a0a7-4613-b054-44fec2a8cd4a", "comment": "Malware payload (Mirai)", "value": "8de80ff4f61364849ac18588f381e1bae23c8c4d1b6cfe7a14e8b4af5c4d6228", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879010, "uuid": "0bf2c871-7f9b-4a02-ad14-4206ac172af9", "comment": "Malware payload (Mirai)", "value": "8ee5f40face2753f5afcb7afad011c1dd1a9d950", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879010, "uuid": "0bc6c27d-71c6-4b82-8dff-354dadcca21a", "comment": "Malware payload (Mirai)", "value": "9353da12529c603bd5bafbce540b2bcd322eecf4821fca2c32dbe213b53d7bd4c210b1afb2712a23889b247c0226a87a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879010, "uuid": "aeff6a3f-2cd3-47ec-9b83-dac197b72ba3", "value": "T18E33AEA7C429AD90C1054774A8258B790763E90293A72FF69B84C6B6904BEECF31D3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879010, "uuid": "34cf637c-f66d-4c65-a268-68266d7842e0", "value": "768:RaNFcEwtf8Yz8Q5cse2+EnerkVT8HH+zYpes25/q7Cdohb1XWxC4o7xc:RaEEwtEUeEz++spVE/q7NhFKC4o7xc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638879010, "uuid": "b014924c-5d8b-40ea-a117-19217b34ace7", "value": 54900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638879010, "uuid": "86eba4e1-f7c9-4ac6-931f-e1482f702f52", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879010, "uuid": "ecd62e9a-2f64-4666-8af2-ae0c84a65e50", "value": "4bdabe6841030c3781df27409813cb19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c8cd3d1-5716-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638851275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638851275, "uuid": "1f1ddf9e-3e6e-436f-9227-b27eada6a1ae", "comment": "Malware payload (AgentTesla)", "value": "cfb05b10f4e9db658aa31eee2b17ca1e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638851275, "uuid": "2246dafd-ad83-4796-b3af-accab2381aa1", "comment": "Malware payload (AgentTesla)", "value": "8e4f36f7dd0346096fd4c674c64008f9443e839d09f623631f88cc25cb849311", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638851275, "uuid": "7263e01f-e325-4eca-8842-d8b02a80121f", "comment": "Malware payload (AgentTesla)", "value": "89ff22aa7722bdfbbebffab3bb1cd123eb314a85", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638851275, "uuid": "68739254-b009-414a-ba04-7d34e750f103", "comment": "Malware payload (AgentTesla)", "value": "25fa5d28f6c3fec64e87982bb9d0e54e6fd36b00f18be71ed41c35dcdf9ec306e92d5a3325d289aef139663817dc4957", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638851275, "uuid": "834fad85-2921-42f3-9e6e-53cc345dfc03", "value": "T1334501C2DA858291EC2C1FB961761C748367BE65B9B1E20C8D88B0F527B73D71132D9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638851275, "uuid": "f87cb92e-f5ff-4a00-986b-f8d212a531fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638851275, "uuid": "5aebf8b6-3efc-4420-9cd2-dbab7dc8f041", "value": "24576:+AU5XTniuDWM5fZzoMvTbVepzaxg+5BAh18V3Yp3stcpd1:+ZDnoGfp/PgzaPW8V3Yp3s+d1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638851275, "uuid": "790ec552-1ebd-42c9-8b30-016f2007ae24", "value": 1166336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638851275, "uuid": "c5600198-0d3c-4a17-930b-5dbb66f070ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638851275, "uuid": "4b0d01ef-47a6-4b38-82fb-2c811bff70a9", "value": "DUBAI DHC43234.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4fa8f37-576a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638887716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887716, "uuid": "e456dec9-7daf-4b09-8f01-bf2f7e267f75", "comment": "Malware payload (Mirai)", "value": "da9ad56a4c23322c69023cd356183dad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887716, "uuid": "b8dade2c-a4f6-4d9a-8e8d-0ddda1c616b9", "comment": "Malware payload (Mirai)", "value": "8ff1049b518656a8a4980cad2aa02aa0f7564bfe241ac78901adef82e6c955dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887716, "uuid": "f6d146e0-7fdf-4fa9-883d-a6ab070b90fc", "comment": "Malware payload (Mirai)", "value": "2b9c3ba0a92dc20d98999a03180ef90c219f7ea3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887716, "uuid": "3df077bd-2eee-46eb-b713-eeac9b5e9c16", "comment": "Malware payload (Mirai)", "value": "3904fa92492c5a10db67dfe7dd32c14716c198223c30ce6dce07ea4297b596589b874cae2bced327aef565a0fa4d0864", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887716, "uuid": "e3080555-7e27-462e-952d-ade8beb43fdf", "value": "T1D1B34B4395A59FB3C192A97224BB69300716E9524F1F1B9972399BF8030F8DDB40FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887716, "uuid": "e09e84b1-921f-4cd4-9807-cc190b1706bb", "value": "3072:xRChH4L42H/3Q5kQDCltW2Y/k4ImUf0q7GlOrsp:x5/OkqUW2YlImUf0q7GlOrsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638887716, "uuid": "e8fbdc05-f6ef-4f96-b664-c6f36c83b204", "value": 110674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638887716, "uuid": "f2adb332-0905-4689-86b9-28d08ae77d0d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887716, "uuid": "f5f35132-6e96-4c2d-b691-85a647971bc9", "value": "da9ad56a4c23322c69023cd356183dad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc9b222-5751-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638876696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876696, "uuid": "609b0df4-2224-495c-8746-0fc545219e37", "comment": "Malware payload (Formbook)", "value": "b9bab7464729bcbd5eecf28e598bfe4d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876696, "uuid": "e4f088cd-7039-42c6-a6bb-206aac857faa", "comment": "Malware payload (Formbook)", "value": "910b1e687bf0031c11e812c4c0802e9ca6381621a082fbc39aa87c0d5cdb5da0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876696, "uuid": "3e193902-8172-431e-887a-002056833037", "comment": "Malware payload (Formbook)", "value": "e3cf73ecb601581caf7c1cfa4d52e1db65685d7e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876696, "uuid": "73163a43-4f6a-4434-bc45-55aacec4430a", "comment": "Malware payload (Formbook)", "value": "2c056a7f5bfa7b0acb626538c2be47fa012887249cc5c8972cda0410794980de3ea57780a5647eb3471ac7a7cd2b9913", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876696, "uuid": "6ac51228-448f-463a-8714-5aa8aa3081b5", "value": "T1DD34126B76D34818F5731E3E4D813631B9E9AD61A10CB18C61E2B21F2CBBC42F76196D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876696, "uuid": "b7268281-9a69-4810-a4e7-59caeabba198", "value": "6144:6uMUGdpubW0ANTZ0MtfvxOHe5/MRWiz/YLHFVacmdSJ+:6LUGdUbnqZBtHxq0/MfzYbk4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638876696, "uuid": "bce36cc2-38ba-4f82-8fd3-009d8a81e7a0", "value": 234312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638876696, "uuid": "efb4ce89-b09e-49ef-b028-95ec9b3c7277", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876696, "uuid": "fea5c678-de5a-4268-83cc-51b5e2643425", "value": "DUE INVOICES.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b28ee6-5745-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638871820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638871820, "uuid": "7a63c7e7-e839-46a5-90c4-55317363479b", "comment": "Malware payload (RedLineStealer)", "value": "1cc47d65028ad93ffddf8e93ab2f8c84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638871820, "uuid": "4749300a-fa48-4b8c-990b-3b80399f571e", "comment": "Malware payload (RedLineStealer)", "value": "9128653c8b6617ef33fa0c03d1aabbac841817baf1c71806381333cb88b32ba6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638871820, "uuid": "7b984da2-4e28-433f-a8b1-e89653a8af94", "comment": "Malware payload (RedLineStealer)", "value": "6f0a1b85ece87c4e05b05cd7ba8eaf3256e6619c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638871820, "uuid": "375c48ff-56be-4e22-9f53-ddaf6366d34b", "comment": "Malware payload (RedLineStealer)", "value": "071213afc6fcd6c320044908d96d8951e4c8d57b64cab56d9901d258ca58140ccd3ea10eac1d87afde1280aae1c33313", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638871820, "uuid": "b574e45f-306d-4dec-9c24-019c12424f2d", "value": "T1E1648D10A6E0D435F5B716F85AB99268B93F7EA16B3890CF13D426EE56345E0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638871820, "uuid": "071008ba-a182-4595-990d-8ad54197f9a7", "value": "32bce393cb54cb1fe98663ad8ce84308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638871820, "uuid": "c15dd6ae-4273-4652-a129-8ce9f5174afd", "value": "6144:KL7FuEsHuCpJoOsUsgkNUxZ+rJq3tvVW2wEX1q:KL74EsHuCMOs9gkNwZ+rJgtvVSEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638871820, "uuid": "2536e38d-5972-4f08-8765-37b04875ab81", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638871820, "uuid": "453de1cb-1cea-4fad-8579-cb8bc3aab2ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638871820, "uuid": "d15fed03-5670-4819-a6b9-7c2ca8737427", "value": "1cc47d65028ad93ffddf8e93ab2f8c84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10855874-5759-11ec-96a4-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1638880058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880058, "uuid": "f1d1ce0c-501d-4158-af3b-2305fb7fb685", "comment": "Malware payload (TrickBot)", "value": "7021489a91673b8acf6a78d33121b7c5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880058, "uuid": "1e5666a1-40bd-4058-8268-7e4d7eb07fd8", "comment": "Malware payload (TrickBot)", "value": "922887fb6a1c30bfafa65a5f4541ed5b0cc0cea55af0f13ef67d13dea3cb785d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880058, "uuid": "3d0bdff3-10b0-4439-9c7c-c2a8e8307ead", "comment": "Malware payload (TrickBot)", "value": "87d3d851bb9d17b314f3c1d7b7bdc7b5a2df30fe", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880058, "uuid": "fabcb0c0-2051-45ba-9b7c-6a2acbd41816", "comment": "Malware payload (TrickBot)", "value": "b5eb86242fcba43630feb02d08717f6a5358bb0141174b8075ef9a3803abb55243933169c49a3f9276d119fcbf2ceb8f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880058, "uuid": "1e357eb9-ff92-48d4-9a89-fec430d7db4b", "value": "T181852045E333E26F081E1D5F24A0284DBCD45D5EDDEAC675B96E3B097030AA929843FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880058, "uuid": "bba3712d-ba93-4ff8-bb06-b6404014b0ef", "value": "e75eb1a5e0f6a6f270d53cf83abadcb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880058, "uuid": "8e47ad43-0134-4bff-b9e1-aa6e8df3a9ed", "value": "3072:zl2lguPevfGuVqnpADmSRyXXp+VQFAAP+fKh6t:R2lguPIf3VAADNcXp+V4HP0Kh6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638880058, "uuid": "502a7a1a-fa76-4105-bc13-f42c250385c2", "value": 1865728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638880058, "uuid": "29bab06d-eb26-487c-9f85-748917f3e44d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880058, "uuid": "c0dc4a3b-d799-41e5-bf9c-45188e5d016d", "value": "roben.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c8e9b7-5727-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638858718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638858718, "uuid": "a0901dc3-419d-40cf-9152-e89a41d44773", "comment": "Malware payload (Loki)", "value": "19ff8a218d43a58137faebc2f06938e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638858718, "uuid": "96e46618-99a8-418d-afdc-37be0d282087", "comment": "Malware payload (Loki)", "value": "92850b0540932a668f679582c98d67aca4149d45bcad96dc393078b954b4a622", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638858718, "uuid": "1decb19c-a107-4f5f-9821-b67ca7462a3b", "comment": "Malware payload (Loki)", "value": "6c9c09d7a7cb43476c67ca83dad2f45e3c4f57a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638858718, "uuid": "896badfd-b721-403c-befe-c553c98b533d", "comment": "Malware payload (Loki)", "value": "1304dbe59a5d2cf270b7416c954b93274149fe3aed14699eb7e3dd57113c3c8edbd7d58fe1afab0e1182bb666435a7e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638858718, "uuid": "36ff0ddb-f699-480e-8290-a736c5b1bd9f", "value": "T15815234037F9C76BD5FE03F43A2141A05B7AAC8F8E13C7549EC198E838E27059D94AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638858718, "uuid": "92a118fd-627d-411d-8e05-300a1ea5daf3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638858718, "uuid": "818afc3b-f601-455b-8c7e-c9ef73f323cb", "value": "24576:p/HmyCTSU+4092OXuQBV6Mu25Qq+5INi0cd:p/Hmyz409bRV63XqMINC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638858718, "uuid": "9e45576d-0413-4075-a53c-b0a494c067c5", "value": 947200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638858718, "uuid": "16c726d9-5f9f-491e-be53-b329143c063d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638858718, "uuid": "1c4809ad-d5b8-421f-b19e-040e7c65fe0b", "value": "MD09575646733.BAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ab8499-5799-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638907693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907693, "uuid": "d8f1fdc5-8de2-4b6d-9107-076512dc8521", "comment": "Malware payload", "value": "a35e721f8733301109276fad9218844a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907693, "uuid": "82c33fdb-c035-43c2-8ad4-221181d672bc", "comment": "Malware payload", "value": "928a7f40c2f97604242c3732da8384200984213f832235312b365d6149256839", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907693, "uuid": "795837f8-f058-40d3-8af4-b7c49226fa90", "comment": "Malware payload", "value": "2ae79065a515f98f091dd979cb29e97dd2ccdef5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907693, "uuid": "928d6661-f998-4a41-ba38-50bddfe13e88", "comment": "Malware payload", "value": "c27acfce3a22900736e49001709c5a739a15265cffc50f7fbc283678472b19885626c33b6076e8a210be63b5e46c84f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907693, "uuid": "a4e2dedc-1192-4f3a-b32e-0fd25ce4253b", "value": "T1F994BE01E7A0D035F1F216F85A7593A9A53E7EA16B3894CF52D427EA0675AE0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907693, "uuid": "1ce882b3-3697-47fc-947d-fc0ad487b1d8", "value": "4eb02e1fe9496df33596532c6e671ce9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907693, "uuid": "724d9a68-9db6-4e71-8b07-16a5afdb9a6a", "value": "6144:pzDVcR9WB1aOtt9YL1sCfzAdJA2pVrlpbg9Ep7NRWXRSx:pmM1aQPYL1OnpVRpbgup7qXRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638907693, "uuid": "28e5e821-a8d1-4f4b-90a3-95b634b54b11", "value": 431616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638907693, "uuid": "8413d428-a74b-4274-b39a-2f62088e4b1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907693, "uuid": "d2a043e5-e754-40e1-be2b-0595f7204bd3", "value": "a35e721f8733301109276fad9218844a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbcd09e3-57a5-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638913014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638913014, "uuid": "987e9a47-91ab-49f4-afef-e0f0e5db8224", "comment": "Malware payload", "value": "7e09dabcefa606614038e0fb7861e60d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638913014, "uuid": "9d0132be-5496-4b81-9d64-680583fc1161", "comment": "Malware payload", "value": "92961b73092ec2355b133a3de81ce40245f391b229e5699b263fb596184c7ad4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638913014, "uuid": "7fcde6c9-ed22-486e-a784-87b90bdfee90", "comment": "Malware payload", "value": "6d74b998553cb42995a1b8fd2c7909404b643c89", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638913014, "uuid": "3818b960-7e10-441f-b1d1-e726864a5378", "comment": "Malware payload", "value": "d2cadcec00cf9433a1e2bf8f431dc9dc75918a396f6d92782cb98830c40f14e2e36eb9d56e4954ef9e35f83de899bd0d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638913014, "uuid": "d5cda475-198f-44dd-a410-49c207dfd50f", "value": "T14A7422DB27ED2A2FD053F934A7163A573D7B026002F582564D69A008DDF38C25FACA9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638913014, "uuid": "d3f0f1cd-fe78-46b5-afbe-610d4d315661", "value": "6144:tw+AWpD/RcswEW62dcTMq8WbxL70Dv7QlEoABAOBAJaQWNORyWNORkum0L:tqWpj6swP6R4wL70Dv7QlLzGNORtNORf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638913014, "uuid": "6b58e464-1c1b-4911-a888-c98eb7fc5b17", "value": 361949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638913014, "uuid": "1b11ec51-8f71-4dcf-87f8-92271933cebd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638913014, "uuid": "889e6f6a-4ca5-4a8a-b31c-3204cfca5b75", "value": "vpc0uUb5QX.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66434e6d-577a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638894375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638894375, "uuid": "134bcd15-638f-40f0-b842-eb6368e1e658", "comment": "Malware payload (Heodo)", "value": "c41d2c729a232c9ad997d1a0ca6ea647", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638894375, "uuid": "4ccae12d-1701-4f34-a165-da99f4034114", "comment": "Malware payload (Heodo)", "value": "92e4982051ded134401c04729088ef6eec885d8a7c024524f4fea6ae2e451aff", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638894375, "uuid": "0b29a939-a819-4c4e-aee1-96cfb6798c66", "comment": "Malware payload (Heodo)", "value": "bb57be71648fc27b98a8da0b20a8b4764c244c31", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638894375, "uuid": "1ab89cd3-bdb6-42f3-8862-447f69bd5fb8", "comment": "Malware payload (Heodo)", "value": "72d982cdb98d9a52bee3c01d8d29b097292e24c56cb0e40555f22a8a71ba5c8f957c3582974902203e2c978181c031cb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638894375, "uuid": "26aa4713-cd2b-4681-8398-2ae9901ba212", "value": "T11655CF043D8180B6F92724391238B7658FEC69210B30C9DBEB94ED7D5E25DE25A3E1DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638894375, "uuid": "0a3393f6-07b0-4866-91d0-7387dc6c9412", "value": "ce5896fd181bed8a87ce7f299693cafa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638894375, "uuid": "f2665697-5a1a-4f7e-b136-ce48fc13a7ff", "value": "24576:a/eZY5g4b9/LwRMGS9sBS0EPG9RIOyp+PB9b12mehjfhfyxI+tORocluvCqknhWj:Nihwm98f9RvPXehKI+t6zKi17oN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638894375, "uuid": "fd9f0f64-04a2-45f4-8bac-58e53cd3bfee", "value": 1355776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638894375, "uuid": "cf6c2017-68b6-49e4-afa9-135f3596111c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638894375, "uuid": "40a89499-7e93-4d5b-909c-35b98cb13244", "value": "emotet_exe_e5_92e4982051ded134401c04729088ef6eec885d8a7c024524f4fea6ae2e451aff_2021-12-07__162609.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "006bb178-5720-11ec-96a4-42010a9c0029", "comment": "Malware payload (Blackbone)", "timestamp": 1638855549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638855549, "uuid": "f929cb30-4ab1-4767-8d11-20b9ad1f144f", "comment": "Malware payload (Blackbone)", "value": "682fc20f4a8c661cd6e4fc5dd9d9a310", "object_relation": "md5", "Tag": [ { "name": "Blackbone", "colour": "#4E75DB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638855549, "uuid": "4c4da4fe-b49e-4917-ba1d-05a904a26282", "comment": "Malware payload (Blackbone)", "value": "938a541c59f1c8091d0885683d2c76bfdf0cc98c65637f8dbfa80068ba57f08a", "object_relation": "sha256", "Tag": [ { "name": "Blackbone", "colour": "#4E75DB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638855549, "uuid": "01c58c68-51fa-461b-b977-258e976b5c32", "comment": "Malware payload (Blackbone)", "value": "2df0059f2bebc177e34cc1bdc5f78498eb225e4f", "object_relation": "sha1", "Tag": [ { "name": "Blackbone", "colour": "#4E75DB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638855549, "uuid": "2aac31a3-553d-4faf-9d1f-9f304d9b68e8", "comment": "Malware payload (Blackbone)", "value": "628f978ad8c27cd82f26160846942ca275708e28d9c4398945e28fbce824a3338f052fb25e1067eb6aef58dcf724f64b", "object_relation": "sha3-384", "Tag": [ { "name": "Blackbone", "colour": "#4E75DB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638855549, "uuid": "f9246730-562b-4b3a-b53d-df4fa7872da8", "value": "T14176226F614833A8C416C4345523FD48E2FA601E0BF5D9AE72DEBAC07B6F915D602B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638855549, "uuid": "b92d3172-671a-4ed7-b561-1ee10fa4be9d", "value": "a5da550eac14944736533bc17f4e3757", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638855549, "uuid": "a7a80858-82db-4676-98d7-3465cd229786", "value": "196608:odfqT8Y9s1ipVLvM2wjHPrtdje0rjQmvrdHrWHZ0pc:odij9cYVL022xdjlXRq5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638855549, "uuid": "9b88187a-e2c5-49c8-af43-e0db0c9d4ee5", "value": 7627264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638855549, "uuid": "cd97b828-b76e-4900-9789-092ec8984ac4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638855549, "uuid": "a5a402f5-2b09-43de-a51e-45fbb5976865", "value": "682fc20f4a8c661cd6e4fc5dd9d9a310", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f5576c8-5726-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638858339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638858339, "uuid": "0b8e8212-f4d9-4bb1-a0fd-c5ac73a019bb", "comment": "Malware payload (RedLineStealer)", "value": "8ae78c8e658e64d4f01851fef63b8076", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638858339, "uuid": "8acbfc34-d59f-444e-a667-49213d640eee", "comment": "Malware payload (RedLineStealer)", "value": "94f8655a5751dd58930359931db8e0f3cc0cfe5145eb140b2b8778d9063dd3f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638858339, "uuid": "e42399d4-cc61-4796-9baa-c74b66a0bc4a", "comment": "Malware payload (RedLineStealer)", "value": "3f415995143a7b07fe70f7586d75e7175beffc4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638858339, "uuid": "341267e2-7cc6-4095-8e1b-66df9d71f92f", "comment": "Malware payload (RedLineStealer)", "value": "de2005dba81b543380bcaca46b3a29ce806292bdd26b737b0f7b32fd0dacab720d7d9192d79f9f293a73fa2048445a6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638858339, "uuid": "944a6600-4bed-4b3d-86d0-40521435689b", "value": "T13B65333703485825E6D8BAF422D77F818B34931239F89BDFAE21654544FA493C736D6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638858339, "uuid": "a9deca95-bdc6-43e5-a9ea-8bad77848ffc", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638858339, "uuid": "165c4963-c75c-439b-a99d-fdb479c9eed1", "value": "24576:mhq3Zw4cRX4u7ZLiVfz2dC6GcZc4xgLdx2YcL8KlykEaHNYK3q7oy3NVzLl:wqpDcdPlLAz2dC6GcZc4xKu8Na8U6NVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638858339, "uuid": "542ac17a-4053-4192-a96d-f7825329311e", "value": 1458920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638858339, "uuid": "0357a8b2-2f20-4954-8893-4dfe787d2d9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638858339, "uuid": "188b8873-9dda-4804-9be2-b8923524684a", "value": "8ae78c8e658e64d4f01851fef63b8076", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d444ae3e-5749-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638873514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873514, "uuid": "504ad63b-e75b-4d7e-ab69-f171fd1c8a7d", "comment": "Malware payload (Heodo)", "value": "1bdf051c4fa58041e1f985446906e5a7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873514, "uuid": "90abb37c-ba5e-4501-a10f-79792c95706f", "comment": "Malware payload (Heodo)", "value": "950e1ff7e29430129beadddfff404e056812f75b8e3dd61f7a73ecf4a638807a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873514, "uuid": "b3e83968-1458-4974-9b5a-5db58e0a797d", "comment": "Malware payload (Heodo)", "value": "25c3fadee3bc7f21f224ecb934d73fc5f2330c6e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873514, "uuid": "d011e253-7d3f-41bf-ab85-aafde8e2c5e5", "comment": "Malware payload (Heodo)", "value": "ee9357921c51d034da513c4d1c0e4c6f9b2b763573c3156f811f6df855e2636d8c6dbcba7c20f4c3288ac11a274dbc8a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873514, "uuid": "ebb6b1fe-a01c-4293-97cf-2e4d2404be03", "value": "T134F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873514, "uuid": "5fea37c6-243d-4a41-bc0b-76a5351d7adc", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873514, "uuid": "6d68c2d0-02fb-4854-81af-afdc23b42cd3", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/W:JapiKiBEmj4GbOX399Md9J/0Tk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638873514, "uuid": "10c005c1-0486-4559-ba19-f9bdcb5d8307", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638873514, "uuid": "6f40bd87-075f-4159-9b82-f0a142e03eb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873514, "uuid": "48d7815e-e152-49d5-a153-b1518fa9b923", "value": "T9x4Jmgylc2NaCqFHe.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "710a90d0-57b4-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638919304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638919304, "uuid": "25a6dd19-d15a-494b-84c4-e9bb995d31cc", "comment": "Malware payload", "value": "6a446695dcdcd3231a72e0681b68be00", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638919304, "uuid": "cacda25c-b26f-4995-8f73-c04858e7a8f7", "comment": "Malware payload", "value": "961ca512d46714d8c5e1afbd465a8a1f334fc2d37eaaf4538047e83fce97da13", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638919304, "uuid": "0ab93965-c82a-4a3e-97ce-08dbc214aed8", "comment": "Malware payload", "value": "39246ac95450a9009050f6cd469c419b9eb6fa25", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638919304, "uuid": "d6c4ab50-fd6e-4b04-a0fb-afaeb49aaee7", "comment": "Malware payload", "value": "056d4f48b8417c5e784240d19a2d36978b3a25299c4175b39e414f772c144829806477ee90c081bff6c1d24fc5c66b2d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638919304, "uuid": "3e440280-8c1c-4f8d-94ed-33b9d3d12764", "value": "T17355CF043D8180B6F92724391238B7658FEC69210B30C9DBEB94ED7D5E25DE25A3E1DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638919304, "uuid": "61c7ee4d-50d9-4594-8783-3405634c993f", "value": "ce5896fd181bed8a87ce7f299693cafa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638919304, "uuid": "1ba731c8-657f-438e-b348-ad1def4c78a3", "value": "24576:a/eZY5g4b9/LwRMGS9sBS0EPG9RIOyp+PB9b12mehjfhfyxI+tORocluvCqknhWc:Nihwm98f9RvPXehKI+t6zRi17oN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638919304, "uuid": "939dbfb7-ed0a-4d20-9d7d-95596f51b8d6", "value": 1355776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638919304, "uuid": "087f29c6-9983-42d0-8a80-678d334f5cb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638919304, "uuid": "11b37b66-3416-4318-a038-c14be1244dde", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be4825d-5745-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638871648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638871648, "uuid": "3f379434-f297-4940-b6ba-2b199a9832d5", "comment": "Malware payload", "value": "fdcc933dadaaa96af03d724b413b477b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638871648, "uuid": "32d1747a-62b6-43bb-b8ed-68bb21d0fa55", "comment": "Malware payload", "value": "97fd4b7e95d2f774d13945d33a7eeca5d20d384949da886f618c3bcdd89790d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638871648, "uuid": "648aa070-a4d4-443e-8cdd-20f9f884bac9", "comment": "Malware payload", "value": "2b732a9d1eaa9255db5977a8a85d03c94be22056", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638871648, "uuid": "2bdf82c8-ef33-4958-b4d9-5eaa563e76a8", "comment": "Malware payload", "value": "92661b54787d98499053c8e784da401496ed4115eb0346fed4a52947e62bec54acbb339fc92cddf36246ee31a642fddf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638871648, "uuid": "38fbbd2f-392d-4b31-91c6-abc3f4c59f34", "value": "T1478423E05C5225EC4D62536BA5E187BD22CFAF9CD0E58F81E6EB4F3945CC60835680AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638871648, "uuid": "c32e5af0-0c2b-409a-94b6-cc95e330062b", "value": "6144:XAoGLB6Ecb2rvSKZ1DbK5d7+J0ThO2cgiXNiAYq/s3JbHeONb/cvRoj/BHQ3JjK:QX1OO4y0ncgaNiAYoibHeCOR0BwZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638871648, "uuid": "0a01718a-5c3f-49d3-a2e8-b62e8c5add59", "value": 395940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638871648, "uuid": "8fe84b69-c237-4248-824f-99fe8f8ba244", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638871648, "uuid": "b1c8a2ba-e86b-4a19-b947-9d292ea41d69", "value": "P1.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8f31ea-574f-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638875806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638875806, "uuid": "d442b959-5f2c-4481-8393-1201de94f8f5", "comment": "Malware payload (RedLineStealer)", "value": "b664f1adaf348e3fc894fc751f39db84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638875806, "uuid": "29012678-1958-4eb3-ad58-11552f1297d3", "comment": "Malware payload (RedLineStealer)", "value": "9841b0752650491124a2dd4ccabf9ee79f791561363f160fb82a72a6dd1e280d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638875806, "uuid": "b0b363f8-0d78-43c0-9b0c-61929561cb61", "comment": "Malware payload (RedLineStealer)", "value": "3f05cf4f7b5a8bf8679aa07607335f1a6c886d8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638875806, "uuid": "c0952bf9-55a3-438f-970b-5ce25da66690", "comment": "Malware payload (RedLineStealer)", "value": "f32789f59cc3b2d537fc5df635994f59b760666796b104fd33897836b94625250d3537a466e9904d5c961b8c341f5788", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638875806, "uuid": "81124cad-ae54-4313-b071-886d47cd7517", "value": "T1C4647D10A6E0D435F5B712F85AB59269A93F7AB15B3490CF12D427EE5B34AE0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638875806, "uuid": "dc61f6a4-e001-4a22-87b7-5d86c50c7f77", "value": "bd61429d86f194f3b84d97af55b8c371", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638875806, "uuid": "085df848-3ace-4359-aab0-8c25ed11b8d9", "value": "6144:Yq1ORQo7GBHCglPKUu1N5RNLP35x7JRwud:YqAKogH3lPKP1N5RNT35xzwy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638875806, "uuid": "95d27bc8-440c-4d7e-a13f-5cb5f925bf7c", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638875806, "uuid": "4dfd7f0e-11cd-4e14-ba68-08be16bd248c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638875806, "uuid": "e6a51e61-5ac2-44a1-9cf1-2c841517e12f", "value": "b664f1adaf348e3fc894fc751f39db84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e73da6e-57a3-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638912025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912025, "uuid": "01417bc6-bb59-46a8-94be-b9e41bbc57e3", "comment": "Malware payload (AgentTesla)", "value": "c921f7d56b53d5a1f960aa473549f4ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912025, "uuid": "f341cc0a-a223-46cc-ba02-5634cddfa7c0", "comment": "Malware payload (AgentTesla)", "value": "98523d4e2f0752b5abec20e971dcbf707e24e8a703eac9774e35b1b5793a2c91", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912025, "uuid": "b17eb74b-5447-41f1-a883-7f20b20558c5", "comment": "Malware payload (AgentTesla)", "value": "e41b0eb5ae7ea0a7e7a8a0d5d4351657f67f4a22", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912025, "uuid": "1ce255d2-d232-4351-bb26-0eafcc10b9aa", "comment": "Malware payload (AgentTesla)", "value": "cd4133791bcf369a4b6d8180bc38351b2b220ba5ae6b0612418666a2f541b9f56beb55182e943e02cb05b71fd15d9f2e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912025, "uuid": "2cda6ac4-5ce9-4b05-9976-6d486e10f3cd", "value": "T1B7C401D23480E6EAC0568A72DC73C4A6EAF17F3C232E7D4369E43B5F25B7150921A167", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912025, "uuid": "54c9dd38-4d86-4f57-98be-165fdbd67c0c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912025, "uuid": "5855ea96-e28d-435a-a00f-81c86088e874", "value": "6144:UGi1la6783LooaCXHzdX/2w1sCCd1xhS1lbiaADLSXZ6Z9Bsj5XqjtRsREYEFJ:maMAUcXHBtx8xhUlbipLSpbj5XUsRfED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638912025, "uuid": "8f45da58-b790-416e-babc-e9bb1e798484", "value": 555949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638912025, "uuid": "5e8c3b58-fb33-4ebb-9c2a-96c7cef8a4a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912025, "uuid": "673398b6-ee36-4465-8859-81c36246bb14", "value": "PO 122001 offer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d8bca3-5772-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638891010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891010, "uuid": "dfdaa124-e60e-482b-9819-4690bcf63be5", "comment": "Malware payload (Loki)", "value": "f897d3c27ef52cfedbc13ada666f593b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891010, "uuid": "eb04b95d-6b79-4416-8874-2ffb53286fe1", "comment": "Malware payload (Loki)", "value": "98a582cea388113fa13c1797c7f9ff1c36bdc00fc25bda839373087ca6b35345", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891010, "uuid": "8eab06e6-8ac8-4e2e-96e2-62554e5dc734", "comment": "Malware payload (Loki)", "value": "e00a7e2b7ee678f6023e9d1c4bb9ee4a9769cdbe", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891010, "uuid": "d962a27a-2251-408d-b361-164f7aa47da9", "comment": "Malware payload (Loki)", "value": "bd6cfd72ab5153529e3afe3175adbb68501b580fa65c40d0c8fec5d42707a374835ee79cdb1d029ac31291c28947b17f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891010, "uuid": "8a863aec-73c7-4bc1-8133-39508cc93fda", "value": "T1AF341211B2044D86E36BFB366E9641986C75FF234F3BDC204662B72A1C704E2A63D56E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891010, "uuid": "0158227d-7592-48ce-af74-af5d502f118d", "value": "6144:jkPhQZ5zrcoUG6cm7QB6If4/ZEGp/Hq3iw3nY25v:jLrBs7Qxf6dK3x1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638891010, "uuid": "d8a7bfa9-2420-4842-acc0-0ea001d7d4f5", "value": 234440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638891010, "uuid": "76e4b978-8e7c-45c2-88ba-b7d7e92612b3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891010, "uuid": "0fdc6bec-8a69-4584-9bfd-4eeb7b128763", "value": "Rxsdvv82001.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eeb6106-573a-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1638866875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866875, "uuid": "bb1b0237-3c2f-4ec1-8851-295d5ba918c7", "comment": "Malware payload (RemcosRAT)", "value": "23cf63d650f1e1862a41158933640e8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866875, "uuid": "b898a5d7-d55b-4019-ad0c-905bc5afd06c", "comment": "Malware payload (RemcosRAT)", "value": "9936a6bda8c332e2aec071444db5f68e1b34745412158cad8394ceb3c80d36ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866875, "uuid": "465e3eac-8226-468a-b00b-c61c0e766e5c", "comment": "Malware payload (RemcosRAT)", "value": "b2f5946ca43c8140b5f68d0e67b4b96391a2c7f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866875, "uuid": "cddedba2-34e8-4ca6-9ff2-59ab39e9dd54", "comment": "Malware payload (RemcosRAT)", "value": "a7eb753dacaf6b5194a030e6911b2b0dd8d9f07b072bd006b6afe6ad48d38625d7a640346b2daeae33c256f407db47f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866875, "uuid": "6bfc4044-3206-499a-8b32-878d7d52e84f", "value": "T15D359D2672A0D873C23B56B8CD17E7E46525BF106B14DE873BE17C8E1EF9640B816287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866875, "uuid": "31f82a32-2744-4bc9-a689-f5a10b6762b4", "value": "63129113d28408f1ff3b0b14b238be7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866875, "uuid": "bb9c7fc8-93ad-40f5-a85a-7facd5cb1860", "value": "12288:IZLuO0wmv2pdKSKVLmbPy7PXjW1ebIrUxhmKQHwy22NwtIKmmTIy7SdFRcqz:4CRv2pvAmbPy7PaYbIryhmNgtIKuJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638866875, "uuid": "5cdd0cb7-e796-480f-98be-5fcd4fb6de5c", "value": 1062912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638866875, "uuid": "6fcbf0e3-7406-4580-b654-fcd8f933570b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866875, "uuid": "2be668df-ff0f-488c-af67-0616bf6ec92a", "value": "UUCENQAV1220216030,pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05221532-5759-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638880039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880039, "uuid": "b86f7efe-f9ad-41f6-ab85-26496788c36d", "comment": "Malware payload (AgentTesla)", "value": "524652a6a3ebe92d7d085ba703073d38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880039, "uuid": "163cca07-7603-4309-ad0e-3c35451a45f9", "comment": "Malware payload (AgentTesla)", "value": "99dcb49044033cef78bfb5f11083a0c1c8a8e84fc7e0914d3a124c2652bb1cb4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880039, "uuid": "b12e04b9-08f7-4293-9ef5-32e988bdcc65", "comment": "Malware payload (AgentTesla)", "value": "0f01fb6f217327de3afc37c20905a412b583c30d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880039, "uuid": "457061d8-cf38-4227-94a6-75f5dbd83de4", "comment": "Malware payload (AgentTesla)", "value": "c14f1485b255ad7651e38a73c9e56c593ff5560648a36a0aec05793150926530b553729f91b501671eaf47eca5a9a9a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880039, "uuid": "cabf998b-c71f-4143-bc98-cba134c1a8c0", "value": "T1D2C4E093C28618D5FD290771D4334CAD1963BFBABD71A02D611EF97627733C3181AA1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880039, "uuid": "7ef95350-091c-4ddc-8fde-3fa9d6b85c1f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880039, "uuid": "b9556e54-cdac-42e0-91c6-1ac604c4a7ef", "value": "6144:QGiihQjpJFn7NOm6m4FTC7/b6vaieUoLBpVTLpYsHqOUrEkd9OTPLn0:2p/j4Fu7tfLBHTLhNGHd980", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638880039, "uuid": "fcee0034-9064-4e22-aae8-90bfdca1fd2a", "value": 555860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638880039, "uuid": "197ac002-c2c5-4eaf-8ef3-9a32acd475ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880039, "uuid": "288818f5-10e9-497e-8948-b0b4bddf0249", "value": "SAMU-HSBC-2322XUSDX98,500XX17-Oct-2021X.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "891742d5-56f1-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638835592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835592, "uuid": "5c12d34b-b862-499f-b9d9-637d1258f9fa", "comment": "Malware payload (Heodo)", "value": "abf975d0af923518f14266b9406067f2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835592, "uuid": "604d4385-a997-4466-8bd7-b0546985880d", "comment": "Malware payload (Heodo)", "value": "9a4926a61f78df404dc900befaa5f4de042081f9e559575144f42b9637534f37", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835592, "uuid": "9e1262cb-16ab-463e-8f6d-ff9f72b3001b", "comment": "Malware payload (Heodo)", "value": "e012eb3c0e109830486a0819f0b07d55553576b9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835592, "uuid": "cd838a64-e85e-4919-8148-f87afc42ceaf", "comment": "Malware payload (Heodo)", "value": "3146d9c98fdc6aaa86b99bc0f7dcb3adb6bae44e5ec01a1794ee6f853597fceb02cfb5c833fc773139587c889df605e1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835592, "uuid": "5974892a-b64e-490c-a40c-5f4f0dfa7934", "value": "T104F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835592, "uuid": "91186ac8-f505-44eb-a161-e36104a0e5b0", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835592, "uuid": "bb16de11-10e7-4380-bb3d-7e3a0304c943", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/t:JapiKiBEmj4GbOX399Md9J/0Tj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638835592, "uuid": "0c0bcf1d-f1fc-4ae9-9115-ced6869486cf", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638835592, "uuid": "bdad0db6-37cb-46cd-ba4a-09665652bad6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835592, "uuid": "b1a2f4bc-d70a-4d7a-9ee5-bac69d637a75", "value": "emotet_exe_e5_9a4926a61f78df404dc900befaa5f4de042081f9e559575144f42b9637534f37_2021-12-07__000628.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5641c815-578a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638901220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901220, "uuid": "cc9f9b03-296d-48b0-ad79-0fe1724c3ebd", "comment": "Malware payload (Mirai)", "value": "68dbe412f49b107f5279ff4c499d4dbd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901220, "uuid": "e34f7216-314e-4461-bb8d-599942076675", "comment": "Malware payload (Mirai)", "value": "9a55d577bbcc601674f0dd4f525a2cc2a7c21edbbadfffe8b277394fbfdc8515", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901220, "uuid": "ce15c65a-d77b-47f8-9620-ff08870f6140", "comment": "Malware payload (Mirai)", "value": "e9788eb6fb6d4df3dd58bd4428471cede1ff1715", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901220, "uuid": "a084943d-31fd-491c-ba3f-e061036ffdf9", "comment": "Malware payload (Mirai)", "value": "739d3c14c0d7abd2b0a5ea43fd6fbc36dfb88dc58f38c17aea78e33e30322151dde181550f8a895da4cea3147eeb9857", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901220, "uuid": "f33195e8-a68e-4e49-9ecd-7ef98474b1df", "value": "T1CE434B0232680E17D5A21EF5353F27F083EEED9121E4F689254FC796463AE33458AE9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901220, "uuid": "2366cc19-9927-49df-9ea4-e699b5b76dd9", "value": "768:vETst2s/uhZo7Fgbb1vJdQ/uQ4G7LK5302vyeLr6QjMXjhu6keoSnuNRvVx:2hrb1TY2dB2foSnEdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638901220, "uuid": "fa0bb8ee-288c-45d2-b8ab-ea1788b17b36", "value": 55604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638901220, "uuid": "c72e51a3-09a0-4f8b-8575-e8e53e647b3b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901220, "uuid": "d1f66b6b-c398-4663-bd33-f440e6736f07", "value": "68dbe412f49b107f5279ff4c499d4dbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff9992d-572f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638862018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638862018, "uuid": "2763851a-2d0a-4459-b315-84a689ca2bf5", "comment": "Malware payload (Heodo)", "value": "795f4a7ecc639fc49ae9b217ba6ce9b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638862018, "uuid": "02e58c0d-2034-4e07-81f3-d70dafc2d4b0", "comment": "Malware payload (Heodo)", "value": "9b8efdce4465b078f2948a910687e017c8a2fa922b7c706a7a76504708e4b971", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638862018, "uuid": "ca8bda43-5940-4d39-8794-68c4df5dc7ad", "comment": "Malware payload (Heodo)", "value": "75b911b0671a1f159bbc8be6d74940dcf4aa7718", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638862018, "uuid": "31d35602-f89e-45e4-b4fe-773c41ef1a12", "comment": "Malware payload (Heodo)", "value": "fbb4ec1d788e282e1abe6acab8851c9c97f317a04998e14802f8d8c2a55221aa3d8a350010ec8de0388df84bdd67cda4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638862018, "uuid": "0b3084be-eed4-4855-8b49-8f4cd25333cd", "value": "T1DDF48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638862018, "uuid": "07f7892d-7291-4379-b191-e56842ca9492", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638862018, "uuid": "ff24757d-c6a0-4b56-aa71-4e0402d7d4f0", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/k:JapiKiBEmj4GbOX399Md9J/0TC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638862018, "uuid": "068baa1b-24a6-484f-bc6d-0de153db5c08", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638862018, "uuid": "549891ed-c99d-4dc6-9144-de87bae4b766", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638862018, "uuid": "6e6682ad-4f6f-4a63-80c0-4ef79c8790d8", "value": "795f4a7ecc639fc49ae9b217ba6ce9b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734267be-5752-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638877217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877217, "uuid": "748d41fc-bf90-4400-bd61-579568575b98", "comment": "Malware payload (AgentTesla)", "value": "7852b1c1f50908691a8007ea368b84fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877217, "uuid": "130da9a6-96a4-4ec2-9ae4-84f075ccb7e9", "comment": "Malware payload (AgentTesla)", "value": "9c16a15643b0f599a8b9bd9f611fac1fdcd3584cb0bad01e6f597f9eeca0aba5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877217, "uuid": "2e9e4d06-32a3-4121-b103-3f8232f7961e", "comment": "Malware payload (AgentTesla)", "value": "7820c24548a1b1cdee157a3df4b7221cdb1f70ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877217, "uuid": "6b75f584-1e0d-48f1-a633-178209cfbf65", "comment": "Malware payload (AgentTesla)", "value": "550201ee09f831ddccaea8534d28d73dfedf00b2bb4d78ae2dd246638d1a87ca0139061e3f85253d46eceefe3daeae64", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877217, "uuid": "21286f7e-9ebc-4b66-9537-498c6290bf02", "value": "T1843522AC3A93ABDDD5A96376332980B846B63C32552BC68CF849350F0D372587933B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877217, "uuid": "e1b4ae4a-d039-4da8-aa21-de167625309e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877217, "uuid": "9d013137-5dab-4e67-837e-5ea328f23e21", "value": "24576:KAEsbC6G6MoBcUAWdAij15KpH10GaR5NBfEHJRCXQ:e6G6MoBcVWd75Kp9aR5DfEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638877217, "uuid": "f863290b-8d5a-4060-a76c-ad9b17661e5b", "value": 1133568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638877217, "uuid": "50cd2707-8dae-4a67-a2de-1ec3c1d2abf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877217, "uuid": "b19ead4c-9086-48c5-b8de-b2899db8e938", "value": "Hesap_Hareketleri_07122021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc08bd2e-5769-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638887244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887244, "uuid": "b0cdd434-946c-4a40-9a75-20e33d3444ba", "comment": "Malware payload (Mirai)", "value": "68aea11488db84e09a94d38e4240a4b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887244, "uuid": "06991cf4-6a08-4061-9dc0-51a4d1bb9eb0", "comment": "Malware payload (Mirai)", "value": "9c652a5e62894f01e9cff5ddf29bf87cc42adea7009c000863ea155e7b760ea0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887244, "uuid": "8d8b1f56-fd73-49ee-82bc-51afd5b0688d", "comment": "Malware payload (Mirai)", "value": "7251655c158266bacdb5ccf120c0108c7b00fa22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887244, "uuid": "5b67fb82-524e-4dec-adfd-f90a76b10793", "comment": "Malware payload (Mirai)", "value": "6190996f3ca3a1724573509507dbf44cd307b57024ee19a6f05fb45dfc4327a35b26fca6c37ef16f2e22b0c39c7a09bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887244, "uuid": "0f1c7a3f-7d74-4c30-9d42-a4a7b3d4efc8", "value": "T13923F1CA2609E562AC605E26D52C4C96630FB7B8F5E8379236144E8D35EBA1073E32C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887244, "uuid": "f82939b9-55b4-4785-883d-125eb011440a", "value": "768:dGPx00ys/aBzvodwe09iU3nVYpZqdi/bm8Mc5f+w8QajPPs9q3UELwgdqqtwOlie:dMODz6wQwYrqsK8MWf+qajP9LNdt3lP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638887244, "uuid": "2e6fb0d6-0ef6-4055-904b-136b28b14990", "value": 50108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638887244, "uuid": "f8803e0d-d88f-4a58-9e8b-65ebbfb17231", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887244, "uuid": "e3e6acaa-2774-45ce-a7be-e9e362ed3a8c", "value": "68aea11488db84e09a94d38e4240a4b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb6299a-575c-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638881560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881560, "uuid": "be7cc90b-6a7d-47bf-9218-69cee08a72bc", "comment": "Malware payload (AgentTesla)", "value": "4b575e669f390ab39c082e6d8133708b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881560, "uuid": "bdbb1e01-830a-420b-a7de-f870ee2bba7e", "comment": "Malware payload (AgentTesla)", "value": "9cd6d23182be8c80adb829e2166460ae654c1fb32a23ad25d56f1aa33bffc728", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881560, "uuid": "473d2871-549f-40dc-bfe5-e2441a0659c0", "comment": "Malware payload (AgentTesla)", "value": "761d75179627f35dbda43fdb6e2d83a3fbd8ec97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881560, "uuid": "5ddff7a2-e68c-4f59-b0c9-c75c1e041f69", "comment": "Malware payload (AgentTesla)", "value": "fa88838cdc2f9fd534c3010047f903278133180cdc185c917267a3de7217b565e35729627d9562475688ffd8eca4ef9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881560, "uuid": "5562a5c9-c3e1-48d9-b080-7b08b4823d91", "value": "T13355DE6B257ED1DAF99C7EB4772483601AB22C66013BE05BD45F7ECAD937203E5221C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881560, "uuid": "6063a469-9deb-4844-9168-335228aba315", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881560, "uuid": "9b59a10a-94e8-4506-81b5-6ad454159244", "value": "24576:5/axS1JEqFuzUFnxwuPBmMjZKuoBcYzo9pJhsgOaLZsN8RC:5/axSbEqFuzA/PBmMjZNnYgJSgANL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881560, "uuid": "69cb5f31-130d-4b67-b8b9-865aa05e2ecc", "value": 1295872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881560, "uuid": "20407454-b79d-4397-b75d-c154b7355351", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881560, "uuid": "9f3de4d4-2474-4091-b8ac-aa506b93a3e8", "value": "4b575e669f390ab39c082e6d8133708b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2447e5a-5751-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638876920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876920, "uuid": "4d6de2fb-1f31-403f-97f7-b0515e851692", "comment": "Malware payload (Loki)", "value": "3e394c13803c59c1fc460f571feead9d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876920, "uuid": "305113be-7fc4-4fa7-8723-beddbf22184e", "comment": "Malware payload (Loki)", "value": "9d449c058dcdaae63205924da47742565c4ffc5f18af27b02be22914a9348b0c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876920, "uuid": "9d82e9ef-eb20-4b94-95f3-0c6c7021f1c8", "comment": "Malware payload (Loki)", "value": "d9fb25f3e87d1d72ac80107e7f25922eff1939c7", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876920, "uuid": "7bc42cb8-7679-48b4-90d2-65c882587c85", "comment": "Malware payload (Loki)", "value": "53218b98079d3b7dec1f350974bacd5d2b113630ac5e96fc6d73f6751cbc0eb21dd96255a16f4e85de8edbd9f1df8523", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876920, "uuid": "227fa7df-5f11-44d1-982d-eba1eb1d0dbc", "value": "T15A34129D3131BD3EF46CE5394AA38E3C58E1DC253824B49357D6BD5D99F8DC12048EA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876920, "uuid": "f89e0a73-e5a1-4d7c-b9d2-7774b4c1d7fc", "value": "6144:Hr4yG/BEHexBl1bSlDYFhO7O2Vj1i/KSqyv:XKbNdQDyN2VIiSq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638876920, "uuid": "87850441-f89f-4b16-91f1-182a528f3d5e", "value": 234360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638876920, "uuid": "8b8329fb-5b85-4a58-aae8-0cbc13466219", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876920, "uuid": "88003ed3-8e03-4426-8da4-adc8c8447643", "value": "swift.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8424790c-5726-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638858347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638858347, "uuid": "2c71a6bf-3e5e-4088-a883-6ca6666c6bce", "comment": "Malware payload (RedLineStealer)", "value": "af3e72baaff0c1fc986ccd2e99f1c506", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638858347, "uuid": "00de8de7-be4b-4aef-a3cc-dc66faf64313", "comment": "Malware payload (RedLineStealer)", "value": "9da7b4e27292080a1754a51e8087e6c7d0929eadcfc942be2485f57b561c1162", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638858347, "uuid": "db7a3f32-1829-4620-a2ca-117230ef8be0", "comment": "Malware payload (RedLineStealer)", "value": "97b7a37335e47b284992b9f32a3ceecc36e89b29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638858347, "uuid": "cf73b6c5-73bf-4df0-a053-fb8c98fffccf", "comment": "Malware payload (RedLineStealer)", "value": "6cc7e70e6fde31132d69afb41887972b84d19a1224405697ec5a782cb1725e275c71f92b67705f49437adb1cc597463e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638858347, "uuid": "f55edc42-108e-4802-b372-bc04b82cfc44", "value": "T163A34B5877DC8A14E2FF0E706CB1511883F0F5A37402E75F5DC654EA2E66B816A22AF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638858347, "uuid": "068e0e19-0877-478b-ba25-4adabd074f6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638858347, "uuid": "fe294624-e1fa-4130-b92b-238e667d9336", "value": "3072:aD7OD4w3MmefIrLT/VRIR6JL7xG43S1I9vAE9Y:j4sMmefIrb75N+8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638858347, "uuid": "c30e88b3-8089-4f46-845e-2ec5c5fedf7c", "value": 106736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638858347, "uuid": "1dccf850-09d7-4fa7-9b51-b8c8e6c78178", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638858347, "uuid": "de474fa5-7cd1-4785-9224-5a5f30f05044", "value": "af3e72baaff0c1fc986ccd2e99f1c506", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "742b5d03-57b4-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638919309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638919309, "uuid": "08807cb9-915a-4ea1-ae9a-d95498cc8b9b", "comment": "Malware payload", "value": "9ee0430d1be9a79854808a80f0041fae", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638919309, "uuid": "17276b13-29e3-41d8-b0d7-095fb515127b", "comment": "Malware payload", "value": "9daef3e2241a78d2c1c9b6f6410068e7fe460408c7ad487daaaf225290f89eee", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638919309, "uuid": "5021e6c8-4db5-4226-97f1-ac3bb9aff2c0", "comment": "Malware payload", "value": "d0ac0d72bdd58b7d38acf44037e7db1e6562a6c0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638919309, "uuid": "7070dd80-658a-40fe-a847-8ea8c9f6ae00", "comment": "Malware payload", "value": "bc6f7f827b3625c0285294067a5613e26316d7052b261a7f09dbb662aaf06b28b29fda03875a8a206a6f2e1b2fa7c5db", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638919309, "uuid": "57c82f6f-cd24-416a-b359-e6e009a44002", "value": "T18555CF043D8180B6F92724391238B7658FEC69210B30C9DBEB94ED7D5E25DE25A3E1DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638919309, "uuid": "471ab564-789d-4c6b-8170-7dd5d05e939a", "value": "ce5896fd181bed8a87ce7f299693cafa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638919309, "uuid": "ba47cdbb-e94e-4ba0-911a-8c8398a5fbae", "value": "24576:a/eZY5g4b9/LwRMGS9sBS0EPG9RIOyp+PB9b12mehjfhfyxI+tORocluvCqknhWD:Nihwm98f9RvPXehKI+t6zyi17oN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638919309, "uuid": "d1680a67-c4dc-4490-9bec-7a92d4d0a05b", "value": 1355776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638919309, "uuid": "6cfaf22b-8a15-4a40-b7bc-8a07b7556fe1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638919309, "uuid": "5ef1fc1a-4848-4150-b3ef-c8f936d095ba", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2396e6e-57b4-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638919494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638919494, "uuid": "2748a991-fa9e-4732-8127-d85bea507821", "comment": "Malware payload", "value": "b38b0c3d8ee34498701a1acd1b668bfa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638919494, "uuid": "af2aae36-e841-4786-bc41-b49180b469af", "comment": "Malware payload", "value": "9f1273a233027420ee4aadc51b63038972a6498acd3c407b01ba2397a0229b27", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638919494, "uuid": "a293a255-d483-4763-a144-cb2528af62af", "comment": "Malware payload", "value": "5be51fe89c461f3cb0e6f17fc1586d41bd4b5a67", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638919494, "uuid": "bf5d18b7-213b-4676-b1a4-5de0568127c0", "comment": "Malware payload", "value": "ffeebfa9dfcc59ce5f43c91c8c78b18194894f32fd1ebe7a8756c031075cdeb19190089a0c6b050e2aef5d8c8046a2f1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638919494, "uuid": "3ec5890b-2877-47f5-aa0b-27e4c298a9e4", "value": "T1431339BBFD89C8B1C2503474BC1ED319F87A1AF46D1E14A1B3AF2C09DDA9381159E5C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638919494, "uuid": "a06c2e9f-5283-4d6a-8c25-f0bda9757b15", "value": "768:ulL7RhbvT2qoQCwqoNLR9VVbnR7iI6iKkQnbOYwIwsyKVBNTXA9eimZz48TkXmVI:uDV72qoQHLvVpnL63kQnbOW3pTXTFZU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638919494, "uuid": "6870068d-8965-4fa9-812e-acdac2064527", "value": 41565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638919494, "uuid": "74fb745f-679c-4400-9c85-1bb3c1709ca5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638919494, "uuid": "983fb310-a874-470e-bda0-8db8342e79dc", "value": "9f1273a233027420ee4aadc51b63038972a6498acd3c407b01ba2397a0229b27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec4b38d8-5772-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1638891164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891164, "uuid": "bc1c9f27-ae6f-4f31-be3d-9b4691a1019c", "comment": "Malware payload (RemcosRAT)", "value": "11a5def6165212e71172f07dabab81ac", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891164, "uuid": "0af55d0d-aa23-4fb6-bd4f-a25a8be9b51e", "comment": "Malware payload (RemcosRAT)", "value": "9f3b21ee151e3b1a21de0247b10d9b728aeb9ce94ca346dfb81a92993ea731d9", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891164, "uuid": "bf752d8e-c6da-4bec-8c7b-990f46d43665", "comment": "Malware payload (RemcosRAT)", "value": "7163a900288ce71ad0756384e2c51ea96588efb1", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891164, "uuid": "1fbe400a-b4e6-49b6-a91c-640e163ebccb", "comment": "Malware payload (RemcosRAT)", "value": "99118677714b775274d3bef94271b5f98d96090143f1eb6bbb7dc494b93a77ea0809f85a0a2c3ed112b37aade6b23d20", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891164, "uuid": "a4686fbc-a830-4e6a-9d90-8d8e0cb91279", "value": "T17055C6E4CC4E76D06E0D671AD0BF678B890A899C7FC0C63E762F502845A9180F5DAF5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891164, "uuid": "42e57f4d-0ff3-4c64-b867-55ec06dc9e20", "value": "24576:i6XYEtYzhQa8CcomwX/PrVVpaLOdJZ/9DM:i6K8KJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638891164, "uuid": "be7c15ed-663d-4b5e-ab8e-38dd606c21ce", "value": 1390391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638891164, "uuid": "c6457aba-5d18-42ec-8aa2-1306ccfb4ebb", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891164, "uuid": "ee39cd82-0426-4e83-ae0b-0ba59b29319a", "value": "cv jULIANA.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51312650-5797-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1638906795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638906795, "uuid": "365e2d17-ac9d-4b1e-a5b0-2f739dc11fa4", "comment": "Malware payload (RaccoonStealer)", "value": "04d100e41d3293bf444651a39dc4e7e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638906795, "uuid": "a259893c-0927-4528-9994-b8a5444e71e2", "comment": "Malware payload (RaccoonStealer)", "value": "a0877c88f33ff8f10eb996d99bfecfc8fce5ab4d78d9e86574c63d13a275cfd6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638906795, "uuid": "591fbe50-5506-4d35-9cb5-51225eacd09d", "comment": "Malware payload (RaccoonStealer)", "value": "2e9070a7c7e8e92b6a21170165628ebee2220a63", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638906795, "uuid": "32a5c94e-aa4d-45cf-ad5b-a1fc4250f4f9", "comment": "Malware payload (RaccoonStealer)", "value": "f7b5f58fe28eeab7321462000612c74e85765d7ad23cb938e083c9387b8ef47c92e4c3df84b4a426e6fc28d50d7e7a5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638906795, "uuid": "ef09b365-5abd-42e0-9087-887f67046a9a", "value": "T146B4F11136C0C032C46124758925C3B1CA7FB87599269A8FBBD52BBC5F352E2EF3671A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638906795, "uuid": "894b1367-1dea-4c2e-aaac-dc4fad56f6f1", "value": "3e040a184666b793e8b84904205dc569", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638906795, "uuid": "68aebd0a-867a-4699-8f7b-9b03b5592ea8", "value": "12288:0S6vbpN+1aOJqJeHEZAhnuweNvWVkQWzGLOc:16dN+1aTekquWVczUOc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638906795, "uuid": "c3ddcb0f-c444-4a97-baf0-6253f6cdc4d3", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638906795, "uuid": "191e938b-1b52-4468-a60b-52bdf4bd605c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638906795, "uuid": "43b2bb9f-b39e-4d67-8710-1c862e99a576", "value": "04d100e41d3293bf444651a39dc4e7e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7048d58-573b-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638867533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867533, "uuid": "6f7e2412-dc12-4f2c-a531-6302c8f9f18f", "comment": "Malware payload (AgentTesla)", "value": "5136838ad541898c64c0c16762700172", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867533, "uuid": "4376af80-fcc9-4a6a-91e7-624c03952224", "comment": "Malware payload (AgentTesla)", "value": "a095449c62bf97ce7c7e49c83eb5ec090150b3cf2b5e3f6be43505780c12a398", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867533, "uuid": "2d902505-5d84-49a0-9030-54528e8dc697", "comment": "Malware payload (AgentTesla)", "value": "21658229ac60c7f1e4280304ca6d0bd793d1408e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867533, "uuid": "7a86b95d-7cf3-4e8e-a15b-46701c900678", "comment": "Malware payload (AgentTesla)", "value": "6e5c92d493654fa7cfb502926d2ac33836f65a0abdd80a4623ae5ce9453b503cd15b0e530fbefed00bcc9817cca4ec8a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867533, "uuid": "a860701c-9bdc-4bc9-b4ec-582fdd4dfbbc", "value": "T17635332ECA54ACD5E1246DC97ECBE3DB03F9ACDADC5418A52F365EB7090A480166D30F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867533, "uuid": "221090d3-60a8-47d3-a162-d53f89fcc248", "value": "24576:/+7VzgF9bIoTSbDlq3ry6DM3epkjkA9DXR03uo14/x0hX+jhW+qNgPlq/:/+7VWIoV3ryNemjkA9DXRcuiwEjgPlq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638867533, "uuid": "f2a0661c-7e9c-40ff-9a14-a12653cc1217", "value": 1159618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638867533, "uuid": "224b2f78-e7ac-4674-b861-f502f24aedba", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867533, "uuid": "259faca2-e176-477d-b5dd-2ae82df3c0e9", "value": "Invoice #763.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b00061a-5752-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638877230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877230, "uuid": "d422aa02-a7b1-40a9-9e31-7dfc16d4ea23", "comment": "Malware payload (AgentTesla)", "value": "a02590b7e7341e6af9da040676882db9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877230, "uuid": "2acaf7d0-b12b-4bd3-971b-3ea66dd041e7", "comment": "Malware payload (AgentTesla)", "value": "a0fbdac32b76f64d77101acde3272056e200d8bd9a5a6eedd1f5125558f2b4ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877230, "uuid": "a700da32-395e-4317-bf74-a3b85f8a7c7f", "comment": "Malware payload (AgentTesla)", "value": "a754c265a6931d0990ee7db50f046f53c4df0c65", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877230, "uuid": "01dbcea9-c5f5-4611-8812-8b356e7b695e", "comment": "Malware payload (AgentTesla)", "value": "e49a244dd4424931ea9a379f924f3e08868dae450dce399bb7b299633552e72a1c31e76d007274a1921177e6b83a81a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877230, "uuid": "227f688d-8808-4a35-aa34-2f28f82e3a39", "value": "T16035230032D8963DF8FF13B555E061A60776F45AB911EA25ACC3A8DF3797B488680B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877230, "uuid": "33fce9fe-fdc6-418c-9df0-a441c6785c21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877230, "uuid": "2eed7a19-b810-4aac-b4b0-fb1036175ffd", "value": "24576:f1K+QW2xcI78kOOGy7tOtvSLIATUKJjFP0WhdH0DoM:fk+QYIo7OZt0v7GUyjCKdH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638877230, "uuid": "8213abde-ecd5-4253-9365-937a05d500ef", "value": 1106944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638877230, "uuid": "4081b6c4-1449-47db-9fef-03970dbeec40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877230, "uuid": "9fb18284-72d1-416b-8f0d-89e28e508d36", "value": "ait Aral\u0131k 2021 tarihli icmal ve hesap \u00f6zetleriniz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a563544-57b8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638921011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921011, "uuid": "a3f06cc0-b413-4785-900a-532d05d9f49e", "comment": "Malware payload (Mirai)", "value": "937c3e5d6665add31f4fc43449cfaa00", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921011, "uuid": "e918adaf-995c-40b1-81f3-37384ce156bf", "comment": "Malware payload (Mirai)", "value": "a13ed280020e33f9963644d1ad47048f1cf1b68de3ece0ca1fba62290eb2b7f5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921011, "uuid": "5650b1d4-e95a-4701-ad73-16e7a71c849f", "comment": "Malware payload (Mirai)", "value": "9262c2e71a0875bb302762714625987c31224442", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921011, "uuid": "5545c38e-3fcf-402f-a823-ad4516f4711f", "comment": "Malware payload (Mirai)", "value": "b99931950123885ad0131857c9d9054a331e902c7e62ae6aec2a018367b8710661eab6f6960f9fdb23aff7990e458309", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921011, "uuid": "7c2a2706-3f43-46b0-b920-27a25ce76e44", "value": "T1B9D2E16AE597DB80C59B447658EF7B5D4428C2096C4431E2BEE9F15FCC04F103B1E2D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921011, "uuid": "94b71f2c-885d-4bf2-80a8-18a547db5322", "value": "768:7J55ogT+lbYMTq714SV4puGZzMELmag24ionbcuyD7UHQRjG:35oDlYMTmGkOu4LmagjRnouy8Hyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638921011, "uuid": "6af9f3d7-36b5-46b9-9d41-84e22f8e5f35", "value": 29700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638921011, "uuid": "0c58cf87-fca2-49cb-ac9c-d1ecbd3772f3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921011, "uuid": "782f4dfc-e814-45b8-ac51-5ad9e08057b2", "value": "trynagetmybinsufucker98575.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538e0651-57b4-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638919254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638919254, "uuid": "26ffa51e-8fe5-488b-bcd2-06c6b79077d7", "comment": "Malware payload", "value": "698f498af05b23b37383d71fe8f42f58", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638919254, "uuid": "8c47ab35-8766-4045-b7a9-6d9668e37b1a", "comment": "Malware payload", "value": "a1abc4a29a402de36595914063517a5a0d34c47b1e05d2401ab96e6ecfa5d7ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638919254, "uuid": "b58c19e0-e4ca-4594-bf28-a3dc18b5ea18", "comment": "Malware payload", "value": "9bdf72110043265c9848a94e97d6c896d4524cfb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638919254, "uuid": "d9a1cb65-2fe0-4884-9524-02f4cc8a421f", "comment": "Malware payload", "value": "8df9c89655995677309c69f609a640a52494a12782094392744027892cf34918353c3bd07838cf0fb6435eba19566246", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638919254, "uuid": "33bbcda6-3ea0-4aff-b87e-33ffd92d87de", "value": "T1EF35227C3AA3A6CED96983B53769903852F27C3B105BE24CD46E324F1D37705B9A3612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638919254, "uuid": "5627763d-53db-4fe4-bdf9-703bbe767e1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638919254, "uuid": "934c92ee-677b-4c5b-a8e2-a285acab4fe4", "value": "24576:bVBvNw0EY2SyiZtr6w8RK81D+kQ+D0BqLr+P/AtrYaPeKPxAb:JBvNw09zyAtmwoK8+O0ga/u52KJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638919254, "uuid": "52da3f1c-51d9-42ca-a3a7-7b545497500a", "value": 1091072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638919254, "uuid": "cbd06ee3-2fa6-4dfb-986e-7f5d1cec9c45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638919254, "uuid": "cb8bfff9-5e6b-4434-a24c-3175e2f8a71b", "value": "Escanear copia001.pdf..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1944448d-5778-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638893387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638893387, "uuid": "3c26cdcf-6091-43bd-b4e1-7bfc7bf1f9be", "comment": "Malware payload (Heodo)", "value": "8153ecc74403165483c793f23d8c532a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638893387, "uuid": "e66eb6fd-fde7-4636-affe-9b83b534442f", "comment": "Malware payload (Heodo)", "value": "a1d7fa3f909f3aa9975e7a9879d1556976550c76237e099aaf76e9e6daa3c07d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638893387, "uuid": "50d3a5e5-4d69-45c7-9c1e-201361964bcd", "comment": "Malware payload (Heodo)", "value": "af49fb201584ae9b61e6460827ef36bbf908cd1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638893387, "uuid": "e500f2dc-1afa-4432-bf4e-cca5e0762945", "comment": "Malware payload (Heodo)", "value": "9f84fb31ea9dd574d7a32258cf3210de076c47e862ce22b673a8f64b4cbc063d379ad83993a457bf79b181d914ece8f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638893387, "uuid": "f050c85a-a640-4d9d-9a8e-dbf563d36a51", "value": "T1AD24D0B171808439FEBF66385D34D1845BAEBD90CB21ACEF7614019B9A685C08F73D7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638893387, "uuid": "59af8af8-4344-481b-a10c-dce2be094756", "value": "35dc3f1eb8a03291fc0dc93396a967d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638893387, "uuid": "bc12eaab-9cb9-43e7-836e-f09dc65c2219", "value": "3072:MCDoXOpFVtI8/7gsEKr8x7tiUabb1mVDthQhdYJBoo31kCsIN7Giz+w/gnViasLI:MGoX+VtZ/7vEKrWpwob5Wo39sjC/Wss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638893387, "uuid": "0ecebae4-f615-49d0-8fb0-2650d772dc41", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638893387, "uuid": "2acb3c8a-821a-438d-a781-4ceb8f9bc4a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638893387, "uuid": "0325b63a-840f-4803-bd54-adfe2fb86e2e", "value": "8153ecc74403165483c793f23d8c532a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74217927-575c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1638881513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881513, "uuid": "ee10c829-62b5-4a26-bef4-1a4f7901502e", "comment": "Malware payload (Smoke Loader)", "value": "3a87c6ab8fd971e87b302d98f665ee9d", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881513, "uuid": "3c454270-8272-46b4-81a8-a2b9204a8007", "comment": "Malware payload (Smoke Loader)", "value": "a1faa15df9d3eb9aca07c47b568e4a7e0950b05e1df5d81af9701a43b6893f8b", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881513, "uuid": "c5207149-bc9e-446e-9d20-3da9e0f6d6fe", "comment": "Malware payload (Smoke Loader)", "value": "7e7b3acca6d6d46c1d5071c5ef4aeed69eb41cb7", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881513, "uuid": "bc965781-ce14-471d-8a56-7c19982ebf38", "comment": "Malware payload (Smoke Loader)", "value": "290f855b2165fb2fff534e43bb69c4c39374a28f46ebc20c415edae8b0bd14a0c1b1f0f4f43892d1d60781b3e1f907f2", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881513, "uuid": "5c031a87-b05f-40d2-a4c1-cf1f36bc3e7b", "value": "T1BD648D11A6E0D035F5B712F85AB99268A53F7EE16B34A0CF52D417EE5A346E0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881513, "uuid": "5e473cde-0037-40a8-a383-fbd608069f5f", "value": "32bce393cb54cb1fe98663ad8ce84308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881513, "uuid": "80cfaf89-cfb5-4e7f-8cca-325b4f82730d", "value": "6144:ke5KpaNNB7XYk/UVZBPH+b3jVu4L07EtGMlJ:kePNNBYk/kZBPHY3jVXo7ezlJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881513, "uuid": "705d2ce5-1f8d-4c55-9520-4ecd13f98451", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881513, "uuid": "a94aa97b-5b71-423a-ad4d-461c30f27886", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881513, "uuid": "e25d8d7c-c85f-47c7-98b6-870bcbaed2bb", "value": "3a87c6ab8fd971e87b302d98f665ee9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b144981-575c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638881525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881525, "uuid": "f9606528-198e-429b-98f1-258be1bcd00a", "comment": "Malware payload (Formbook)", "value": "299d8629d8233d33035dbefb2b754adf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881525, "uuid": "411658c7-b479-4b5b-8c9c-d5bbbb1714ff", "comment": "Malware payload (Formbook)", "value": "a2430f629b428996d1c3b6a62e9f5c0a85f02a4eb0b1dcbd0090ed44daee2525", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881525, "uuid": "92c23cd8-4aec-4492-b0e5-afdfe75dc171", "comment": "Malware payload (Formbook)", "value": "47ea18659001494aa5f39a58cbb355d8b8da463d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881525, "uuid": "1667b8a4-0c64-45ef-b833-45d0b68480da", "comment": "Malware payload (Formbook)", "value": "919815397c5dfcd25b021c05a43bce045b122fbb453a0a0654606e07d7625b66f0ed07fa50b9990ba3ece64023f5c6dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881525, "uuid": "2c80c8d2-7557-47c1-8751-28c00951963c", "value": "T11D6423E4B392E977D4A219B115BBB731F3BCD2F505D79E4B4F049EBA2E304020B62952", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881525, "uuid": "7fb90ae5-5cc2-49c5-b60b-ac21fd8308ec", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881525, "uuid": "e37fb3f8-0a81-4fb2-96bc-c0ee49fa8e35", "value": "6144:rGiuzf65aU/VjG2o1AXdzn9UC8xYp9SPsGmH7Heec3dI2Iqrz0O+iigqAW:m5Uz8m44SPsd+ndIPiigqAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881525, "uuid": "b4b19d25-8f8c-49c5-8ab5-786138be39d9", "value": 318560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881525, "uuid": "34f477ad-5233-4ef0-aea4-580d5e4dfea5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881525, "uuid": "cd32ad98-70a4-49f4-8f04-c4a96869729a", "value": "299d8629d8233d33035dbefb2b754adf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb09e3ac-57a4-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638912663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912663, "uuid": "2e696043-4fb9-40a7-84e0-37832982c2c1", "comment": "Malware payload", "value": "8fe78280fe35787a0f101426101dfc35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912663, "uuid": "9ba508a2-2865-4675-ae85-def2fee45065", "comment": "Malware payload", "value": "a29c97cb43cd16fad9276e161017ae654eb9cc989081c7584f8f14a3795deb0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912663, "uuid": "3276de53-6990-4b6d-869a-91a47f6e6235", "comment": "Malware payload", "value": "cb4095aa9b8ec9f3af38e394beffa002dab14357", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912663, "uuid": "57839124-5409-4d24-9fa2-dfb82c43de1b", "comment": "Malware payload", "value": "b9f58665f4595764cf263ccfb1754e363d67a97f0b5ecd9c74e49761de173fb2620afdca1d417173f2e0054766a2e02e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912663, "uuid": "67827c57-3b1d-4ed3-ab5c-0da0c834f21d", "value": "T1D6D25B0CB7E8C621D4FE077ACE37A91447F4F1874862DB9E18E4959F2E237954884BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912663, "uuid": "63be23ed-b0f6-48b6-8ca6-855105bdd624", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912663, "uuid": "3e1afdc7-cdf0-4bbb-9e64-b393856a9b64", "value": "384:RPdoiU696lRFOBwz6rCKz2ranDaf3XABB/txnIsdS/+e7QeKw2LdH+adaEU5wrGB:Ab696lEVkaDS3XABjS2eoPH4/pCv5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638912663, "uuid": "0b4ac7a2-0533-4d0e-94e1-b85e22490948", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638912663, "uuid": "e9db7e42-5ead-4b8c-880e-7bd175937be7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912663, "uuid": "3e7aad26-278a-4c8c-bd1c-88389e576818", "value": "8fe78280fe35787a0f101426101dfc35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df6e7f89-5755-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638878687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878687, "uuid": "4992c1cb-8280-4620-96e7-423493502549", "comment": "Malware payload (Loki)", "value": "de1ce0d31e5c0f703ba21b9f32ae8b34", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878687, "uuid": "045e7651-bf2d-4f39-8153-3359b74e8230", "comment": "Malware payload (Loki)", "value": "a32c6199248e24889f6e4a50c1eb512401090850d491726af56dee3218520a88", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878687, "uuid": "84160e10-f5ee-49db-a989-63846baf04dc", "comment": "Malware payload (Loki)", "value": "366a70f8c32893ed06b93afd1f226ee3cac1d343", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878687, "uuid": "6b549434-2e52-4a50-9855-7292817ce3eb", "comment": "Malware payload (Loki)", "value": "6c6aa9dc95039031b44fb6b01428baa1662247bc3b71c2d16f985d93abced41379ff80b2a5b7dda4ef7a99b90fbc7c15", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638878687, "uuid": "5dfb4f1b-9945-41f5-8dda-a766b3c7898f", "value": "T1267423D15A26EE83F27041545291E64DD5041E0EB243DCD3A169EE9A4CB3E02F89EEFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638878687, "uuid": "6c6bff22-c23d-4b7a-9c47-7dcfe07254e0", "value": "6144:g1GzOhsuWNcJbZ5KovBNXvaB1YzBdtctTXjzlDw50V7I5EwVx7eyv5eFbeZ:gHsmM3MzvtunFnATVxi6eFbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638878687, "uuid": "e752a65a-675d-43a6-b3c1-98846fd78775", "value": 346147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638878687, "uuid": "3b4ccdf0-36f6-40ea-9501-2620088d836f", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638878687, "uuid": "56270a07-2cd3-4bf2-a946-39f3bd04d494", "value": "Xerox_07122021001.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6271604-5778-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638893757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638893757, "uuid": "73e07887-24d2-465b-9b58-ed71a4fdc0d3", "comment": "Malware payload", "value": "7ec23ba764169ab253c8e775a12ca98d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malwr", "colour": "#FA093E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638893757, "uuid": "78bbd296-8359-424e-b14e-3351da0f43ae", "comment": "Malware payload", "value": "a32c95667565386c3a4a48d63daf7baee7367bb0657088642d1e733d0c40b1ea", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malwr", "colour": "#FA093E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638893757, "uuid": "32ef024e-d2fd-4857-bc02-391fe39bbcbc", "comment": "Malware payload", "value": "791568d9a8e7865bfeed8838a15683a0356adef7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malwr", "colour": "#FA093E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638893757, "uuid": "95899a34-de62-47b6-915f-68855762b110", "comment": "Malware payload", "value": "7b8a5fc6c7aa36d5eb44a7aba74f5877e40fa85ccb3112fbd0f7316b2a97763c289173152d8190e3412e0407a7bb5351", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malwr", "colour": "#FA093E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638893757, "uuid": "cea3fe8a-e668-410f-811f-4095aab73946", "value": "T1A3360193F748E02EC9F3C5334AA20776A1965C4E8957E2132EA5B25C4DB7D805F89FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638893757, "uuid": "09e35109-2ec4-43f6-a64d-24714f2a9da6", "value": "98304:Hk4o4MAxqS+5NjnzcHUdUvpSHM3beiVlPs7Iarlewrm:no4ZszcUCSHMRZcrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638893757, "uuid": "0f469420-cc20-4f35-bd28-b5a1b3d13bf9", "value": 5055102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638893757, "uuid": "3594cdf5-e28e-408f-b611-0399dd2f847c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638893757, "uuid": "cf634026-4d02-49d8-93c5-b4d66c0eccd3", "value": "Hardi Dict_1.3-0x01x.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79016b6-573b-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638867426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867426, "uuid": "b977051a-cfad-4df7-83fc-36c1fbd2cc4f", "comment": "Malware payload (AgentTesla)", "value": "29d86c78e084050a5d8adf046c6e1730", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867426, "uuid": "d09a8c06-985c-48c9-9a0b-563bed05442a", "comment": "Malware payload (AgentTesla)", "value": "a3304e5249ff1c2d77647ed4a3ea250453546e096d7dd67454fcd0578978bc5e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867426, "uuid": "a481d761-fab1-4114-b052-946024f9a64d", "comment": "Malware payload (AgentTesla)", "value": "a0615b09e3d667c18b9fc598f99bcc8cee38aa6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867426, "uuid": "6e079678-ba92-4bac-b12d-80b0f39707e6", "comment": "Malware payload (AgentTesla)", "value": "1055262049f1cd93e55f4f1acd4f52277963da20fe34dcf5f1e86da4b843dc5b0dabfdefa4aa2ad9183a716ad624b8fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867426, "uuid": "0d205a6d-0d86-434c-869a-5057413bda0e", "value": "T107F4332DD9084A9D45CA2804C567E79CCBC8B6DFEEF09488D7A1ACD29A14F5F583BC06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867426, "uuid": "daab1272-8166-4838-b4ed-918484a60511", "value": "12288:v73rI9e6dALyUmL7NSVim4EZXqhGZzkLEMveuKc7EaJegxqRYpoi2YF:vY9e0ALTmNI4EO0wLFveuKcIaJegxqnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638867426, "uuid": "8a965892-d054-40a7-bd85-fdc782130b7d", "value": 775863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638867426, "uuid": "ee7a6c73-6cb9-4ef3-8bf9-7d6808d7b96d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867426, "uuid": "68082b31-7a27-4c60-b8fb-c5d9b8dce14e", "value": "invoice and packing details.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b1e24f-5764-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638884920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884920, "uuid": "15178027-2265-4226-91e0-89d1093b9504", "comment": "Malware payload", "value": "dfca89113df15361eaf0ee5a82fe69f9", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884920, "uuid": "e12d6674-922f-4f17-9268-db677edfc88e", "comment": "Malware payload", "value": "a3c1884cfd4a3d905f273e7fe7f028625dc961c3ad816692b28309606ad1935c", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884920, "uuid": "5a5496a9-cbd5-468d-a0df-4bc889a61278", "comment": "Malware payload", "value": "9b9614216163517823eb85bbf2d1f9515d6485d3", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884920, "uuid": "a855cdfe-b5c0-4f88-be3d-2fe60dea60a2", "comment": "Malware payload", "value": "75003c87e85908ee1c25e31031b6143a70956d1d1b423cdd229d6e3e53dcfdf4ad25ea0ab2b0b8576e0791000fadc6e4", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884920, "uuid": "2a6ed7a2-7fe1-41f4-8c5f-0fba4d89c7dc", "value": "T1ADC57D22B2D1C537D0772A78DD5BA399952ABD202E288C4B3BE43E4C9F39740791D2D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884920, "uuid": "15d00ce0-e77c-40ea-9e4c-d7caeed802cc", "value": "24576:trUo+5MgdMz4W5AHkb+iLeZLao1y7Z12DUlSKJqn02xDT1/9O6XJayELVTU+zX0o:trN+KDiZ+Z1i1R/sVrRTPzX7GYM3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638884920, "uuid": "8ee5b4f5-2540-43bb-9178-c430763b5ab4", "value": 2575872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638884920, "uuid": "b64e2754-2fec-40b8-85c5-73b6011dbc9c", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884920, "uuid": "cdcccd8a-e5ad-453c-9653-89ff24cd28d1", "value": "Factura_fpyuhrmgeaqbpiansiapegdmbyutuggdjegtphfpxvdcimwbdo_55372456856.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c313b84-575b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638881044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881044, "uuid": "1df1a7c1-1e06-488a-ac4b-02b59f27be03", "comment": "Malware payload (Formbook)", "value": "622035fc398d27189a29d638f80e18de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881044, "uuid": "4101cdfc-19d2-440b-8ef4-be0ce270b73b", "comment": "Malware payload (Formbook)", "value": "a48338ad920df299184caed650b6105804c67269494766bdb8651f4d288b8a0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881044, "uuid": "4689848e-7863-41e1-a824-b05d1fa57c73", "comment": "Malware payload (Formbook)", "value": "d0e7fccc95884144d90e19cba81e88923ebd9a1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881044, "uuid": "317f2a95-d1e8-4564-8ee9-8d62ae9319f4", "comment": "Malware payload (Formbook)", "value": "2050c48b3457acef15a1595b9dcbd09e531b67ad3a89ba59b7b99629f645ff7b947f26565b06bb4419b6297ba8126059", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881044, "uuid": "4a7b050d-dcce-4673-9018-6f4172c21e79", "value": "T13474235F15C88DA7F8A18C768672975FDB3AD42213E047AB93F00FBF5EB62638118650", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881044, "uuid": "8fe1ee77-b058-4908-8f60-99fa9e2ad72f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881044, "uuid": "ab2eb48f-49a7-478d-b25a-7fb64fdc9e5f", "value": "6144:rGi4lu9sLuuhAoC4RYMBrJm7+SJcx/zC9fvZv7NfZvTTR2eGvIA1:AuquurRNNSG8JvZpRLsTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881044, "uuid": "ceb96957-6761-427e-a8cf-139b2a44bcff", "value": 367344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881044, "uuid": "dfb8dd85-0e00-4549-b38f-2e1a8af244b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881044, "uuid": "b40f3a88-6c38-4513-a565-6a2c30b475fc", "value": "622035fc398d27189a29d638f80e18de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b131d32-573a-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1638866868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866868, "uuid": "2798029a-8f79-45ef-abf5-3b90fe2ef09c", "comment": "Malware payload (RemcosRAT)", "value": "879b8457054ae721d58b079add6e7b38", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866868, "uuid": "f2c4b819-3361-4b83-9971-5e05d7899ea6", "comment": "Malware payload (RemcosRAT)", "value": "a4e00539efa24fa0dc30fef0d933d48fed1bcb90edfd1c6f639c53646a18cd3d", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866868, "uuid": "057745b5-3a96-4fa4-b86d-253c1877f495", "comment": "Malware payload (RemcosRAT)", "value": "47a57a56163dfee83cf1738ca6b4ff6d1dfe0236", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866868, "uuid": "148047c4-b156-4ce4-ba81-486022e15959", "comment": "Malware payload (RemcosRAT)", "value": "d553ec97d22abb406f3e534828020502537a31e6f417309e9c8bdafc141190cb5ae0bc0e2499e57d9468367bf95dcd56", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866868, "uuid": "7d2d2a08-f3c1-4881-b856-23032dfa9152", "value": "T123942356B003608999FA1708397D98DBB95E2D7883037140FBBE715DEF66816386FB2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866868, "uuid": "4d66b192-eb7d-4e56-848d-615fbd6060f6", "value": "6144:pVMPbFaFtk8Cfn9r3RI7ksuC7X7lUpvXdOhEl0l474c2jdEm8I2di5zQfLQ3maBD:30RaoVuXRuIQY+2JEm8I2Jf0374Ud3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638866868, "uuid": "667a20fe-8c64-4f77-a6d8-6a839bf589b0", "value": 413049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638866868, "uuid": "4b0b90f7-d93b-498d-ac4e-e0ac6f4b8846", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866868, "uuid": "7d629cc5-629d-477c-9dd2-3dc1a182784f", "value": "UUCENQAV1220216030,pdf.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f97c0fda-5770-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638890327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890327, "uuid": "3c697d65-e304-419f-8d89-16c1ef524254", "comment": "Malware payload (Dridex)", "value": "89da7c34dc93eda18d3c6c6bbac62caf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890327, "uuid": "fd07e1dd-176c-4485-ab3d-d11d28537fd4", "comment": "Malware payload (Dridex)", "value": "a4e006e1e42223f696e27a50307aa424ea378a6eb2eb0ac20d41a21d9ebcf009", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890327, "uuid": "6111d2db-928e-4e6c-9aee-997d2681bc5a", "comment": "Malware payload (Dridex)", "value": "dd52e1173fe30cba2c2c4c7bb929f6d1ff704738", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890327, "uuid": "eaca175a-f2b8-45a0-8888-ed8331f4cdd6", "comment": "Malware payload (Dridex)", "value": "583f262c99a1a0a49cb5664be5874430d57abc054380a7c5a86d5e55709ffc2a554e59e4ee66bfeada6e2f54447de09f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890327, "uuid": "4090c9c1-c9e3-4de9-96e2-c3b50bdb4315", "value": "T13534E8D69EA6ECB1EB85C1708CCD37708625DC701E494383B168A33AFE2B5789F84795", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890327, "uuid": "a61a7163-dd18-42cc-88e3-7274fef92d54", "value": "6144:096FE76hr0d3n98AdwL3x2bVyyKC7Au9CQZI3dMoMCx2nfT7c:48qnLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638890327, "uuid": "c54383ac-a2e9-4aaa-93dc-a9d59bd36e83", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638890327, "uuid": "6d5f0791-1c1e-427b-84c8-a07d4bbe822e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890327, "uuid": "3ba55e67-98c1-4cfe-98b4-88576a2e6c64", "value": "SecuriteInfo.com.Heur.15304.31200", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b72881-5741-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638869728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869728, "uuid": "494e9852-a00c-4d05-86c8-bb672c103b04", "comment": "Malware payload", "value": "7a56be033509ae415be14577cb90d05f", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869728, "uuid": "d8a4a6ac-6261-4b76-907f-50cb4574b8ba", "comment": "Malware payload", "value": "a548b90ea08de51f34b69852b35b42e68546a46ac21cb40c9593abb0a876e5b9", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869728, "uuid": "702aaafd-7a81-4d38-b688-1ccf03693fcc", "comment": "Malware payload", "value": "f30bb7682f4891818479281b2ece21fefcae9a7e", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869728, "uuid": "7be8f7d7-47b3-423b-9b46-7cef07e20415", "comment": "Malware payload", "value": "34553772327a23fa3a145caec66e5e20b27b02b14713dc19bb1fb8eb15a934ce84e956e5b7f0f5180687eb8182ca7a6a", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869728, "uuid": "454d8f66-3060-443c-a705-5d35f5bb88bf", "value": "T176D53392519D8B43B55834F7A8869A40D337632F01221A322EF4621A76FFEE55F38F07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869728, "uuid": "3210da74-65a1-4989-9e63-2f79e88f2e26", "value": "49152:AIzRD5V8Ai2B5UMpeeU5qez25nc2IOQCLeipUXjcJvJGElPxlKzsivbjW+n1QqHa:AIzpf8AxmMAbz211rvpUXjEXp2Zbv19a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638869728, "uuid": "33d0c4f8-bc7a-4693-944a-bd5e4c5a555a", "value": 2878984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638869728, "uuid": "8e9d116e-20f4-4fde-b579-cc7541f569f8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869728, "uuid": "2a30e4c5-e696-4f40-bb33-fa25ad7fce83", "value": "MX 211844-202109.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab8077f7-573a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638867003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867003, "uuid": "0772781b-987e-4c25-8694-e27b80129adc", "comment": "Malware payload (Mirai)", "value": "e979fd2aa3c00e5670e42b673de9341e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867003, "uuid": "9530a11a-5835-4fbb-81e8-54f9b61b4c8c", "comment": "Malware payload (Mirai)", "value": "a593e5dcce0c84934ab0489c0b25b4674f66bdaa202d594efb711e3178d17e67", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867003, "uuid": "e04bdf5f-3ce9-4e86-8860-bdec4d3791b2", "comment": "Malware payload (Mirai)", "value": "0041cd2ea1cce5c9159e5c4db3b7c39d7ef5ca90", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867003, "uuid": "5e11a538-09af-4184-ae1a-d317d451d68a", "comment": "Malware payload (Mirai)", "value": "03db71a43bdb2148a547616cdc89502421399d60f7b3882ea9a9dda878a784cf48584a350ca528e4aa3d102e89bbbf80", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867003, "uuid": "cf966ff3-4191-464d-bb41-d7bf6ef84ebc", "value": "T1E6632A81B8928A12C5D513B7FA2F568D3B2653D8E2DF3203ED251F643BC691F0D67982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867003, "uuid": "ad6289a8-427a-42cd-9dac-f92d059bb335", "value": "1536:Iu5J9TxrPqnHzTN5faYxjlAl3i5zM0P2wk5W8TK8VZgPqF:IuDUplxxj6lSBR+wk5xu8jR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638867003, "uuid": "aad53641-a7fe-451b-af7a-95ff606b29b2", "value": 66868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638867003, "uuid": "737d29e6-3bb8-4c9a-87e4-7590f5f7d485", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867003, "uuid": "fa4fb89a-3ac5-4199-9669-1b8426f1de5c", "value": "Antisocial.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1373829-575c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638881723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881723, "uuid": "accef972-e94f-40d9-a7e6-cf34fb566aa5", "comment": "Malware payload (Formbook)", "value": "f670d4f35079acdbb5e7c5b58286ad1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881723, "uuid": "1b8642de-6d0d-4cc6-b819-f481dcebb9a1", "comment": "Malware payload (Formbook)", "value": "a5980948bb83834c850b21ed35bf1ed3d324b4c85f86b82a4e540aeb399eb1e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881723, "uuid": "579347c5-06f3-4d58-ac41-f9c35c93b908", "comment": "Malware payload (Formbook)", "value": "ebcd6560c27e98d643fe48deb2e1758cb39a4212", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881723, "uuid": "5332dc0b-0460-435c-9121-fc51451cd9ec", "comment": "Malware payload (Formbook)", "value": "9da404bd7580adca06be6c9c3c3e794e083120fcc62c8c7866d630a86aace6ea83e90a5c9923a0152d66e75250229fdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881723, "uuid": "67cd726d-f2af-4222-9c75-dbb59dc915b9", "value": "T1AD75F21E56E45E1EC51F37B4B885031107B26697FEB7D7AD42C8E4E51E22BC28A2331B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881723, "uuid": "9cc06026-26a9-49db-a4a2-8200a4895a93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881723, "uuid": "48951a66-6e5f-4e0d-a221-043b204f0d36", "value": "24576:F6uU8+A9ZPqMvRRoSwwF5VfXeyQerSlNy3tL7y2zS0X5UMYv:FD7PlZRoFwteiGlN+7y2zS0pDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881723, "uuid": "b5a9fff3-1508-4cec-a1ed-a91316d3df07", "value": 1604608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881723, "uuid": "67e0b040-7b03-4475-8f01-ab1ad39e94cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881723, "uuid": "98ca2f79-8654-4080-9264-bb0812e13c84", "value": "f670d4f35079acdbb5e7c5b58286ad1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "124d1867-579a-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638907978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907978, "uuid": "baba3913-4895-41de-985f-2fde5a96db8c", "comment": "Malware payload (AgentTesla)", "value": "85a6c313504a78f8bb0cfbc75b12b6ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907978, "uuid": "176d18ca-43b6-45f7-8a91-ee2c824e4744", "comment": "Malware payload (AgentTesla)", "value": "a784d2c3358a4597fb5aec65da9680e17d0f187428971e92cffe819f7feba880", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907978, "uuid": "2598733f-d46b-44ae-9648-6586de78d7dc", "comment": "Malware payload (AgentTesla)", "value": "148668d42c49a51a4a2d5343a56a725c00c0494e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907978, "uuid": "0bd63e47-8a87-49c8-ba72-9a3ee7564095", "comment": "Malware payload (AgentTesla)", "value": "47ca5dbe83df1a55c216a2b88a65d3d0adcc2d8ce309ef99eb09ea0db14c05e34c874f655c8ec150762e2e8a20c76b2b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907978, "uuid": "88984add-86e1-4b8c-80c2-31de32a27b96", "value": "T19335321468BBA01DF0629AF51DD0F6F6BDEAF6B6118970BA63140F329712D41CC7363A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907978, "uuid": "b0c4efe4-5530-4dc4-a86d-55009a297553", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907978, "uuid": "202fc527-2f4f-4c02-ba1b-8fb9fd625150", "value": "6144:+GlGKUioJpbIKusexgIIlNZBk+Zjm25UWSmfenARy838vj5qHA9eiZrc56qkYUob:pSAsexQM+M25Ua7U838vj5qg9pc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638907978, "uuid": "a7c2d289-abc2-4404-b9c4-f3999eba9ea0", "value": 1115136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638907978, "uuid": "fa9134eb-01d4-4f7e-9f19-7a408f0aa22c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907978, "uuid": "c6e33477-432d-4076-abf0-8aea2c23b076", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a98f6d-5753-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638877682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877682, "uuid": "f520be64-b1df-49e8-8b6e-a4397ad2df08", "comment": "Malware payload", "value": "f62d352d05fc5048e5d6292e84b533e3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877682, "uuid": "0913d87f-d10e-4741-b45f-e2904f7eebe5", "comment": "Malware payload", "value": "a7ab47575722f7b3ff2506255c252e88963acd8985263da6b3d7ee7537fbb2bb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877682, "uuid": "99ab0d50-3268-4d35-8d92-f68b7b2d84b4", "comment": "Malware payload", "value": "e09ed160d6ddd939329771464f9f2dd79ebcdc22", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877682, "uuid": "7d0556d1-4118-47fa-a044-486ddbdb5761", "comment": "Malware payload", "value": "e1c7b4adcc336b6c0ba3eea16de906f3b4ee480e861f5c56343779891a96f2bf22dfa213003619c87ad2264bf3359fbb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877682, "uuid": "4ab4c3f1-d3e9-4695-842d-9a64b729163b", "value": "T102A5AD32B27436DAD72125A2433B3F0753297D4BB3D66F18409ECBB45CD98BD2649E0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877682, "uuid": "69778bc5-f294-4666-9e75-d24ac07ed490", "value": "1536:Ybz4J3fbgjEHbz4J3fbgjE3XQMQUQHQ/QNQ2QUQXQNQ3QTQDQNQnQvQ8QCQhQQQ/:nqMGti7YNSB5NGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638877682, "uuid": "52d521d2-f6a4-4634-85f4-6fc39ef66f76", "value": 2214546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638877682, "uuid": "24c843ba-d0a1-41b2-86c4-2ff38684b2b3", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877682, "uuid": "8925a8ae-b2f2-4fc8-a5db-3c452b9c8923", "value": "Order 669 SOS DEI F.LLI CIRELLI SNC.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "772ae751-56f1-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638835562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835562, "uuid": "de23041c-d12d-47fc-84aa-16ad9d6167ac", "comment": "Malware payload (Mirai)", "value": "3d3d39082dabd696382d474e41625ae3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835562, "uuid": "e7b9a7c2-ad1c-490c-8a85-82db226388d6", "comment": "Malware payload (Mirai)", "value": "a7c4ed61f34dab971de223c223e76831bf42bd21738ae939a43e22359b03da4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835562, "uuid": "75505066-1d78-434b-9b7c-5dbe4789ac46", "comment": "Malware payload (Mirai)", "value": "7a9efe71de98ee610dca5de3ac1e76d780b31e92", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835562, "uuid": "1352fcf6-ff74-422d-ac7b-82f0442116dd", "comment": "Malware payload (Mirai)", "value": "aaac871cd8e12e67b6cfccb026a2c58b842353544a912d5c103922e38e9091d2d866fe6c1d25b931a184453e8d6b6be4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835562, "uuid": "189020a5-a554-407b-ab1a-07bc16af8e61", "value": "T19CF2D0E9D2A5BED6CE8D9F78835D4770EF82F0C16289C78C673A4C509626803B44D4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835562, "uuid": "2defac88-dacc-4c6a-9688-c718fd2c903f", "value": "768:xtRc/PiVzanAibM/O+5/Sqtp4CscediCIIjI6u2uQQBWMQ+:x74PS7/j4qDjqdibKu2DQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638835562, "uuid": "fe90ee2b-9bb2-4db4-9070-96c9af19c62e", "value": 34524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638835562, "uuid": "653cdc1d-ab40-4db5-8723-2f9747ea8fd0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835562, "uuid": "3e44980d-f6c0-46c4-a797-9036d5d8d6e7", "value": "3d3d39082dabd696382d474e41625ae3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b58fefe-575b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638881042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881042, "uuid": "7c069393-a941-4440-a818-5fb0de1cd224", "comment": "Malware payload (Formbook)", "value": "e8093e6a8950b5a7558a603be6ab6ccc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881042, "uuid": "4f04cde4-4c06-40d0-9d59-27b80ce35f19", "comment": "Malware payload (Formbook)", "value": "a8026cedc6f508f5fb982c7bd33732418e056de7c82a3633f7f5bd68c6bace9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881042, "uuid": "4c2c8e44-ff98-46f5-8624-154f22cd2f49", "comment": "Malware payload (Formbook)", "value": "ace0206e65b480cff6802ee7439cf020c9048283", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881042, "uuid": "2b3bc7fa-5e16-4290-bc51-c93962c8e417", "comment": "Malware payload (Formbook)", "value": "4915301de60f6479eebf38ccf6a0f81b42f2c4ac4f7a0cb79146fbebd4101564c309f8941e5a26b9400146032ec6f72d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881042, "uuid": "44b80913-b411-4682-995a-14b8b15aaf90", "value": "T1BB35226C32A762CDD909437037B6E07862B67C7B105BD29DD48B728F2937B127A63712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881042, "uuid": "4ac87c22-eab9-4d04-83ba-7772a610fd94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881042, "uuid": "393e9be7-ee90-4828-aa9a-9f83b2c67783", "value": "24576:dt+arPXlDkHeKkpi86C2ud+5vciria42qScTJqXg:d7aDai+2uAFN2a4vPd2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881042, "uuid": "28fe1d18-2aa1-4d3b-9a81-4ba3784de507", "value": 1072640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881042, "uuid": "dc4708af-f493-4cbe-81ca-8552d6c51c2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881042, "uuid": "b07e27df-09bd-4dd8-bff3-aa7281e12cfb", "value": "e8093e6a8950b5a7558a603be6ab6ccc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7130b0-5737-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638865609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638865609, "uuid": "49ea6a69-13f5-43e5-9681-9dbba09080a3", "comment": "Malware payload (RedLineStealer)", "value": "a0d72268918d9c02c50102bf0da7de30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638865609, "uuid": "0398754f-e1ac-4e79-94d5-87799865dc29", "comment": "Malware payload (RedLineStealer)", "value": "a853dc01d947af712964b7aa5f26d8d68f574f669cb9f632400a02d41907175d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638865609, "uuid": "b030e448-7a56-4efc-8313-20451108be9a", "comment": "Malware payload (RedLineStealer)", "value": "f2f0a3b8b2920e102ab8cc5f0ae97ebd3285cb5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638865609, "uuid": "96f2b5a1-0dbc-4288-8ea8-b6300b3c6919", "comment": "Malware payload (RedLineStealer)", "value": "f36cea65b8875b2909e94c3b6c541d33975ddf8c43f1a6121b870c05993c9c9eaf0344d45ef728e4c313528e43c1ba35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638865609, "uuid": "3daffc3d-5e42-4880-bf6f-ecba3e44e36a", "value": "T1E8A4D0E5AB10BF89D4203CBF1571CB85857C650B251B1AD9CEB23AE9C43159CBE2A3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638865609, "uuid": "1f9eb25c-9454-4f88-bdd8-7556c37b9e27", "value": "0f787b62b3622a150a1a1101acb85808", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638865609, "uuid": "70ccda29-4606-4fde-97c3-aa34877b40b6", "value": "6144:U2ICtJqi7TH0FuI1DHefGH+tFG3a5+TcGPFsR6nxRZ0n6PsZlsHCSvkQTnzBsrqh:JtJrAuQkS+tBbGPFvRZnPsZACSverhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638865609, "uuid": "ccc4cae5-e3dc-45d5-a9e0-d7c1047e90ea", "value": 485552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638865609, "uuid": "7f6196a6-c3ed-4025-a883-045217df140c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638865609, "uuid": "680f7c9c-cf0a-4a11-af7d-68882f87af4e", "value": "a0d72268918d9c02c50102bf0da7de30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9690970-5787-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638900125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638900125, "uuid": "f6ee85de-346f-4e7d-83fb-fe0cacd71b15", "comment": "Malware payload", "value": "a9bc5cf6533184cefa144acd7785b7ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638900125, "uuid": "a143ae81-cc72-432f-9ad2-a405c21c9a36", "comment": "Malware payload", "value": "a875150959a11023e8a4fabfc2004a23e830885ef86303f52d6d7314fa88d2da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638900125, "uuid": "be582d0e-5e45-4ac0-9589-8606e9d9962b", "comment": "Malware payload", "value": "c3d98fd30ded700454239e68f9630ffe103683e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638900125, "uuid": "99f57797-dd40-495d-ad80-616490037af4", "comment": "Malware payload", "value": "fd9dae84d6626153a095a686a149b3d320cfae4657b64c8f3528cb6aecadcfefc84ad663434ef8771793316a1154957c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638900125, "uuid": "29399b3b-5c4e-4aa4-879e-25a6c72b5a67", "value": "T14494BE00E7A0D034F1B316F85BB593A9A93F7EA15B7494CB12D566EA1774AE0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638900125, "uuid": "66d13298-d5fe-4deb-934f-45a42d402489", "value": "4eb02e1fe9496df33596532c6e671ce9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638900125, "uuid": "0008c450-af50-48aa-b018-7c04e585d90e", "value": "6144:bZnc3U+75HkZsICnttphEkcNrc8eAI+PrzJ1NtQ0Vx8VZmuI1xuOh:byfNHkZgnTbH4U+PvJ1Ni0V4ZmzwC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638900125, "uuid": "36bc8ce2-401b-4a84-bafe-c0b6bed6dadb", "value": 431616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638900125, "uuid": "23e3be28-b7ee-4198-a6d9-81a01ae9e21a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638900125, "uuid": "ae783511-6f10-4af7-9670-ec074e3f44f6", "value": "a9bc5cf6533184cefa144acd7785b7ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659dd818-577a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638894374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638894374, "uuid": "96f5c9c8-4b80-4b01-be16-6fcba4e95a5a", "comment": "Malware payload (Heodo)", "value": "6298b46339b713571649acc71a398cb0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638894374, "uuid": "9a34f0d4-6c90-4860-b917-2b88882a3c76", "comment": "Malware payload (Heodo)", "value": "a8d4196fc677eaf4f8c0bd70963be490940213fc756f6a37c5fb6044b2e72507", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638894374, "uuid": "1cf0973c-e97b-4b1b-a1ac-7cfe0c89de85", "comment": "Malware payload (Heodo)", "value": "dc11f50c079c075606a017c3c7a1da27a4b497ee", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638894374, "uuid": "af6c362d-9bd7-4f3d-8a38-58070dd095e5", "comment": "Malware payload (Heodo)", "value": "55b5e691a4a15617aa773d0a817ce7ba730e0e56a40b576c784b6733aca7cf8614f44acb975dce411b9a3ac7841f57cb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638894374, "uuid": "9c1dc531-6f7c-45fa-a796-b8ffe8a6f643", "value": "T1E955CF043D8180B6F92724391238B7658FEC69210B30C9DBEB94ED7D5E25DE25A3E1DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638894374, "uuid": "f8fc24e5-e7a3-4c54-a9e0-9fdc97a16643", "value": "ce5896fd181bed8a87ce7f299693cafa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638894374, "uuid": "f26243e5-d3af-4e44-ba79-b547bfc6aae6", "value": "24576:a/eZY5g4b9/LwRMGS9sBS0EPG9RIOyp+PB9b12mehjfhfyxI+tORocluvCqknhWq:Nihwm98f9RvPXehKI+t6z7i17oN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638894374, "uuid": "e551473e-15f7-4749-84e7-2a6a34dfbc36", "value": 1355776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638894374, "uuid": "6f8f5c33-26f8-4abc-9ded-8e1ee6688eb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638894374, "uuid": "45854293-df36-4990-ba2d-e0767c516921", "value": "emotet_exe_e5_a8d4196fc677eaf4f8c0bd70963be490940213fc756f6a37c5fb6044b2e72507_2021-12-07__162609.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b4890f-5753-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638877573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877573, "uuid": "c90f9ac3-e219-4abc-9ac5-74634ba805ac", "comment": "Malware payload", "value": "f3108ddef24ab4fe332c2b40be48b00a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877573, "uuid": "6332c8d1-d64d-4dea-ae8a-9d5414b1911d", "comment": "Malware payload", "value": "a9860796d1d8e596f82c63087df29317a6829fef77fd9d7f518957de196e2c63", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877573, "uuid": "d30fa80b-91b2-41fe-850a-b05aab648447", "comment": "Malware payload", "value": "30f419f6d9535e39a338c8ca0514ad25ac397050", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877573, "uuid": "ed57c598-ae93-484c-a776-f8c7ecaf988e", "comment": "Malware payload", "value": "f4dd95e10f65c4645d56b9a1f892d7175fdcf219e290f2a495e86b7ac6fe959c3baa9953cc304ecc36e414d8521126a6", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877573, "uuid": "91ba1faa-1608-406d-b1f2-b7369222b8db", "value": "T15513BE7CA0B8FA446445D6A7D700F81EAC0A6B3F857683EE6D91B418565CCE48AD2FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877573, "uuid": "d4d88276-2fe5-441b-9ef0-6d52fdd11d87", "value": "768:iG5F/CEbgP1DvF3Ih55UbKXXtOXYHrlZ75ArLvVZOi2s/1Y1a:x/MP1jF3C55UGLAPXOS/+1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638877573, "uuid": "1efc8cb8-5f7b-4b57-84f6-6fc56af9d2ce", "value": 43153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638877573, "uuid": "80f2af84-f933-4cfb-a6db-7fdac0b5f440", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877573, "uuid": "bf2feabe-791f-42fb-a7e1-16dffcb05b70", "value": "insurance updates4921885123.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7f975c-577c-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638895296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638895296, "uuid": "6c073751-68e0-4c22-8b73-9e48768c435a", "comment": "Malware payload (RedLineStealer)", "value": "0eb02080636885cc5c6aa7fbda5ee67a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638895296, "uuid": "3767091a-418c-4fb1-b9bc-3363e9edc859", "comment": "Malware payload (RedLineStealer)", "value": "a9c68b448101f65cb3cc37b23ec5f9a3ca49bcbfc5bb81b2387524f71be57bd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638895296, "uuid": "220cace0-154c-4f7a-bc4e-d46787b1b034", "comment": "Malware payload (RedLineStealer)", "value": "565cbf7e446de7a0e50044441274e34c977c2db0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638895296, "uuid": "feead429-1284-4511-9f7a-a498622dd4cc", "comment": "Malware payload (RedLineStealer)", "value": "b3b6c1b095fd9de8d9b48b7e83c36599aa15ef95a799bc217391b361d421656018543fd35d06c9c6fc675508ad81dcab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638895296, "uuid": "07dd8daa-2574-4b0a-8101-fcad0de058cc", "value": "T1837533668DEDBF1DD2138FFE94133C05E94564A04290BC21BA8AEB876B704A7944DFD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638895296, "uuid": "44927e9e-0660-447f-a493-6523689dc45c", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638895296, "uuid": "07c08f18-30f2-4f3b-8cf1-f8a28a404bb4", "value": "49152:RVsyGgnhiW5eS09/wnCVAa+/3NVjVWPNa4xNHEy4B:cqhOn+CVAa+vnjEFRHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638895296, "uuid": "e7038f07-0265-48e8-a842-6712bfe03658", "value": 1587928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638895296, "uuid": "586811ec-e04b-4e54-a3ef-c3619306fb76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638895296, "uuid": "cd399b17-85b2-450c-b7bf-69ed89e7f419", "value": "0eb02080636885cc5c6aa7fbda5ee67a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f1adb2-5769-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638887206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887206, "uuid": "70853298-7d3a-4f5b-9f9a-3693d9d99dff", "comment": "Malware payload", "value": "3717a70e5f584eebe94ae3562ca2b4b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887206, "uuid": "b2919e4f-0bc6-4ea9-a488-adb08b9841f4", "comment": "Malware payload", "value": "aab4c6c3ea47514231b8dcc620ad25704a9e534723250e4b8f8bd531f32f98c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887206, "uuid": "ae86abf4-d59c-44e5-ba25-94978872512d", "comment": "Malware payload", "value": "638b434326897834b1a1348cc8979a5fb79ae1c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887206, "uuid": "13640678-3854-4b5f-a03a-38ea0fc0f283", "comment": "Malware payload", "value": "eb40a00b1e00a197485d1021484bfee2865583b28204771fc98313114f068ab42e0b3bff94c831ea7dc5ee0950a8f46f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887206, "uuid": "0a1b1dbd-4c84-4210-bdd0-49917a8005ee", "value": "T1E103E178D4286DCDF7FBCE70B8B0475047BB4B9485988F925511AB00407AE15F94AFC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887206, "uuid": "6db7798d-85fa-449d-8b6d-9f05f2cc439c", "value": "768:Xq+WqWycOTuoyvJ7qcs+B+SQQyPisLLeVD4uVcqgw0z4DPWnCl9R:6wrVTAvTBcNPiseVD4u+qgw0zyP2SR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638887206, "uuid": "3ccf8555-705c-47c4-b963-21c7f75e61b5", "value": 40116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638887206, "uuid": "d7a301da-d7ec-4a20-a6d7-799b6d412383", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887206, "uuid": "d3f36f98-fa69-4240-b716-162b9adc8770", "value": "3717a70e5f584eebe94ae3562ca2b4b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19061add-5784-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638898540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638898540, "uuid": "8c78b35b-34c9-4ae8-9f71-68d62c107ad0", "comment": "Malware payload (Heodo)", "value": "d9f23d6a0c8c481431df6935c48a5bdc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638898540, "uuid": "32e18a68-acd8-4661-a6f8-177ed6672cf2", "comment": "Malware payload (Heodo)", "value": "aac2204bfd08cba9fe7e2405d9efc97130b9136d0b238e63d75dbea7bfb64b4b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638898540, "uuid": "1344eb20-0a60-4ca9-adce-4d37a4efc677", "comment": "Malware payload (Heodo)", "value": "892462b407a1c05627be1a600b581040cb6a8646", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638898540, "uuid": "8a3585a1-5be5-45c2-b120-4734d6480cc8", "comment": "Malware payload (Heodo)", "value": "0fafcaca4c406712017b85d486e5bca381201b44e1c7af24a384cabd1c40ee2f6bba765d3cd60ca0fc62659bc47de6d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638898540, "uuid": "b1887173-15c4-4ee6-9f1a-d249ab21736f", "value": "T10B24D0B171808439FEBF66385D34D1845BAEBD90CB21ACEF7604019B9A685C08F73D7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638898540, "uuid": "f9b2656d-341e-467b-9eae-e38be33341e1", "value": "35dc3f1eb8a03291fc0dc93396a967d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638898540, "uuid": "876c3639-ee0f-4b66-8339-e913613155e2", "value": "3072:MCDoXOpFVtI8/7gsEKr8x7tiUabb1mVDtUQhdYJBoo31kCsIN7Giz+w/gnViasLI:MGoX+VtZ/7vEKrWpwobmWo39sjC/Wss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638898540, "uuid": "074e2415-4712-487e-9f34-d20b27bca9c0", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638898540, "uuid": "52662556-4a12-4822-8316-3e61cf65e330", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638898540, "uuid": "93b93ab8-28cd-4f19-94fd-5bc9cb2d8732", "value": "d9f23d6a0c8c481431df6935c48a5bdc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6446bb-5743-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638870708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638870708, "uuid": "76066098-bd30-4c60-81f6-e07ee8c4c5c5", "comment": "Malware payload (AgentTesla)", "value": "edc0f69189e48dfc5a93393462dd3ad6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638870708, "uuid": "8241ea1a-fb9e-41fa-bd92-1d1d41c9bd5f", "comment": "Malware payload (AgentTesla)", "value": "aafb84814fcc522aea1e12fcc6e565bc0732f7c160f5abfd397952b8ee2327ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638870708, "uuid": "fef2ca14-20af-4860-a855-8387088419f4", "comment": "Malware payload (AgentTesla)", "value": "6cd7fdec8f8c904ffe60b9d17189eeed9bb85466", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638870708, "uuid": "776dc771-ac33-449b-bf7e-33f47b455c0a", "comment": "Malware payload (AgentTesla)", "value": "d1a9ae026a0deb03f14f2cc111c02fd4c0759ba08300c0c172f14b8466230f2159cb47b4dd342b24c05c80f131b64458", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638870708, "uuid": "81ef887d-bb1e-4a81-8e22-42b969cab4b2", "value": "T1CD352381326C473ACC6D53F9247400B247B6605BAD74FEA51DC052DBAE67FCDC482AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638870708, "uuid": "7bc5b816-8c44-4498-ac91-9d569b0de422", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638870708, "uuid": "156834a4-0f8f-4744-92c0-7785bd4fb05c", "value": "12288:qmdWLtGO3YlW/CHkSt2VF+oWPH11eo3XwoGL4bmDUD/Vf372sFxPdFvwE9tNH480:fyGUyH/IVFWHgoc8937PFVwu7HYwBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638870708, "uuid": "41c4bfec-ce3d-4591-9108-871baccca1c7", "value": 1058816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638870708, "uuid": "6a6bc2f8-09b4-4db2-8af5-a110fb07208d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638870708, "uuid": "f5420dbe-5fb4-40b2-b3c2-55536056fd3f", "value": "Order_0246309621.pdf(92kb).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c2cb8c5-5784-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638898546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638898546, "uuid": "69908e13-c895-4a41-8a15-6b719a4d43bf", "comment": "Malware payload (Heodo)", "value": "a560cd80ee73521fc1f0dfcfb5330a64", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638898546, "uuid": "6e45677d-be35-450f-a8df-68e6dc5e981e", "comment": "Malware payload (Heodo)", "value": "ac5c8b1c64882c5c01648fc2a82824716e9aaa40e2f9c400b1447a1819b80f3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638898546, "uuid": "72b217ce-aee6-4e24-ae01-e08ad4404969", "comment": "Malware payload (Heodo)", "value": "789496fec2835c06bdfbc16eb320c79f06c7d1e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638898546, "uuid": "2d69b8d8-e716-4b66-a755-e65de82bee0a", "comment": "Malware payload (Heodo)", "value": "8f3571cc3722785200f1d1391cf6e2ceee5445b3ef3e76279082375af52c19cbb9feed59bd0fd8c5a3fa8acb398f3ab5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638898546, "uuid": "f48493c8-1888-437a-8601-332a4cd85b99", "value": "T19424D0B171808439FEBF66385D34D1845BAEBD90CB21ACEF7604019B9A685C08F73D7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638898546, "uuid": "bb1708a7-f0b3-465b-b4c1-ac053dd2fa81", "value": "35dc3f1eb8a03291fc0dc93396a967d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638898546, "uuid": "a7519b81-c574-4488-84d3-1fbd7fa93e1c", "value": "3072:MCDoXOpFVtI8/7gsEKr8x7tiUabb1mVDtaQhdYJBoo31kCsIN7Giz+w/gnViasLI:MGoX+VtZ/7vEKrWpwobUWo39sjC/Wss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638898546, "uuid": "a749c6de-135d-4d20-9481-f991252997d2", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638898546, "uuid": "a481ff88-ea13-49d0-96e0-8bbeb5498376", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638898546, "uuid": "234d6552-8c0e-4845-bbf3-710e5d7dec3c", "value": "a560cd80ee73521fc1f0dfcfb5330a64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b293da0-5786-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638899403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899403, "uuid": "956cb096-992a-4345-9c3d-b24fa8aa47db", "comment": "Malware payload (Mirai)", "value": "c039f6bed9d4ff3268781893477ff018", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899403, "uuid": "aef3361a-0835-4aa1-9e55-8b1e0227be99", "comment": "Malware payload (Mirai)", "value": "ae01b28945c9b5ad429a9c3c73b53ad9582543e111f966f9fd7eb714c4cc06b6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899403, "uuid": "8dadee9d-1e8d-433c-8fb6-c0d87509e601", "comment": "Malware payload (Mirai)", "value": "9310d317c6fe1631f697836daf2a9b6e3e7750b6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899403, "uuid": "1626feed-d937-49b5-bf61-cf9cf1e0d7b9", "comment": "Malware payload (Mirai)", "value": "92b38c37053615a610200c27b0486fd7cf4655a73af6ed8842094e51aec3932839ae952e9f9b19ae9112daf473445c40", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899403, "uuid": "5bddd351-3a7e-48e2-aec3-65b7b8902235", "value": "T1E8D34A46EE818F03C0D5177ABAAF424933229765D3DB73079D285FB43F86A9E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899403, "uuid": "6d4b8aaa-711b-4bc0-93f7-d8e6638bdf09", "value": "3072:b2N8tJx98/uHv8BFVlX0CTgb7SzM/9Lqfe:yNgxGuHv8BF7X0rb7GM/9Wfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638899403, "uuid": "a0f08779-4c46-435d-8591-988e64ab23ed", "value": 131489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638899403, "uuid": "f156d46a-f73e-44d4-86da-52b5fcbd2b6c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899403, "uuid": "3fbe856c-8331-4382-9956-1fc1b288af6d", "value": "kwari.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896e58ed-5740-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638869523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869523, "uuid": "af8b39a7-432a-41d4-ae5f-d2bacfc5e6e9", "comment": "Malware payload (Dridex)", "value": "140f26956439f2543dc1a62cf6c2bb76", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869523, "uuid": "12980745-ba49-431c-a301-4927c373fb0a", "comment": "Malware payload (Dridex)", "value": "ae7e543fdbcf720db3e296cdc5f34d294cc71ac4c6db3fb8a30e85aaece3ffd1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869523, "uuid": "7aa554d7-5823-4b30-b679-6e52ff25709a", "comment": "Malware payload (Dridex)", "value": "9b59acf74f9099ea449e051cce0570b082ab16a5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869523, "uuid": "c6c48911-5147-428a-9003-81e1fae6b9da", "comment": "Malware payload (Dridex)", "value": "e6acc400755dbc844747b760f1a37ea982e35e50e76dc8b1c60c0fcc68e8844c76bafb94ce0f1f0ac84e594567cc5b9b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869523, "uuid": "434358c1-94d1-4d10-8c6e-d4a53457ddfe", "value": "T1CAB313DE8646A939C0D3B5FC030D15F2740E88E05658636FB2F06478AB5CDB38B7EA25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869523, "uuid": "f8263d95-735d-476d-853a-c06710f58db8", "value": "3072:LYkCiztv0U5f5FTOB1SR4CH2URwHZ1kd96:tcUVzTOB9CH2EyGd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638869523, "uuid": "60a2ba42-fb4d-426c-8c5e-fac63c560dfe", "value": 113950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638869523, "uuid": "3a0f4dc4-28eb-485c-bcfa-a1f54672add2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869523, "uuid": "8cbeff70-8f2c-453c-a217-e03e0d7d9d6e", "value": "Invoice37204658152.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa86d88-574a-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638873767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873767, "uuid": "dded1d92-6aa5-4705-b597-a29654d576d0", "comment": "Malware payload (AgentTesla)", "value": "0bcc0b0bda61896e5cff81e5665bfe9c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873767, "uuid": "22ab3848-c526-412c-ac08-470ab3396163", "comment": "Malware payload (AgentTesla)", "value": "af111e1f46bfb7a036f1d13d146b3619a530fd691c6dee191e1235fb1d5f9218", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873767, "uuid": "dc6b51ec-6fd4-40a2-aa25-588705eeb4ad", "comment": "Malware payload (AgentTesla)", "value": "e600f7d6e92313dff796cb89d3d89834620460b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873767, "uuid": "24136714-2765-4da3-876c-24659eef21c0", "comment": "Malware payload (AgentTesla)", "value": "604cb75cf0b64d60f2436cb1c50679eb9e5f0c04599cff3c1cc3fc18af6d9fbd59192f6faa02aac48712af41c5abb33e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873767, "uuid": "3d755b36-f11c-44f3-a6dc-d1dfb6d57cb9", "value": "T1F63522AC329752DEE95987B13326957C92767C725207C28CE4AE329F0837649BD33B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873767, "uuid": "65f2d89d-585d-4711-84d7-3aee917121c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873767, "uuid": "75c3233a-fbc7-4b97-bf10-2e48c6d385bb", "value": "12288:W6Dt6cb7sGVvGN5irVt/6Slu6YLohKG0ai2pWQw30OsU8bu9yZ7G4XBZVxABDqMr:J7s8+IRu6CS9NiPEOT8y9kGWKbbYN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638873767, "uuid": "ebd8205d-c5a1-441f-857e-92c01b9ebff8", "value": 1115648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638873767, "uuid": "0523fd39-6c66-4306-a9d4-63e765473fa9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873767, "uuid": "0bdee0f2-f2ae-4266-b0d4-ebe453ff1be0", "value": "Bank slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1d06cc-577b-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638894972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638894972, "uuid": "c7fc57f1-18ea-4196-b179-19a1f522ade4", "comment": "Malware payload", "value": "2c31471fa91c339ee26cbe274b420b8d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638894972, "uuid": "627f4f72-5d86-4a80-b346-5c0a3ec43895", "comment": "Malware payload", "value": "af77838f1bdae5623f86fb0eb71882ce845a3847c9cfa1a954b2cb5558ce5fb5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638894972, "uuid": "851c2fa0-952d-44d1-a4b6-cc53d94240e2", "comment": "Malware payload", "value": "e1710f6eaad0e550ae279fa0060788abe8085fd4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638894972, "uuid": "add53cc9-ed33-4b3f-b9c1-f415b5266aaf", "comment": "Malware payload", "value": "ca52acaa7d2b76183c4562abdf898475e2806958bf2d21dace8d27c0db79a6ed517effe3149011be2c9d31eaf160bbf2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638894972, "uuid": "4cefaf97-c9e5-4a3b-9e75-f0f8f6fc6cc6", "value": "T1C6059E046D4280B6F9533872227966318FDC56160B30DDDBCB44ED35AE29EE36A3E1DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638894972, "uuid": "0dee9dc1-528d-49cc-9955-fc064bccb761", "value": "24576:a/eZY5g4b9/LwRMGS9sBS0EPG9RIOyp+PB9b12mehjfhfyxI+t2:Nihwm98f9RvPXehKI+t2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638894972, "uuid": "bb9d5d08-b971-4d7b-9633-d396d333d645", "value": 853790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638894972, "uuid": "f87cfafc-648b-4fb4-8f17-50f12cfa2604", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638894972, "uuid": "fe0e712d-5570-4516-b5dd-6b304d7129e4", "value": "emotet_exe_e5_af77838f1bdae5623f86fb0eb71882ce845a3847c9cfa1a954b2cb5558ce5fb5_2021-12-07__163607.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b383862-57b8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638921012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921012, "uuid": "580aa4ff-3f2d-4cf9-9822-6011de4333cb", "comment": "Malware payload (Mirai)", "value": "3dbd0b910827bd20b87d3d3bacbfcd66", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921012, "uuid": "1e124381-274b-4cf6-a72a-79ddd8eaba18", "comment": "Malware payload (Mirai)", "value": "b1a3bd95e971274bd07338788f32ceb85cebc6572d535b360e785338ed4fba2a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921012, "uuid": "1c8471bb-3134-45fc-b929-f23e605e7b79", "comment": "Malware payload (Mirai)", "value": "ca4ffa6bdf4252aaf2db3bc021acd49c59717167", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921012, "uuid": "2e9cdf72-71e9-4c3b-94a9-413471cd38f9", "comment": "Malware payload (Mirai)", "value": "7cb54af7e9e959b6564178afcf741882647343131e8b014b12eda368c7b835585de9aaeaa4fc7680b2130a2662a6acef", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921012, "uuid": "6637276c-6cc3-44fe-be4b-ce13e880a2be", "value": "T152330206D6EF9851CA301D77D6FE5104552FA7BCD491F28643E898E0AEE74CB7278207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921012, "uuid": "54cc62d4-3cd7-4e68-b019-53c73db3d401", "value": "1536:8APtoKBLM7wUJSZsdzEbLBr1/t4iBkvuOPim:8APtcBEbLXV4iBkpR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638921012, "uuid": "099710b3-c976-4870-bc9d-b74476387d91", "value": 54088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638921012, "uuid": "c66fd0cb-1f4f-4753-8607-27a3f564bf4c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921012, "uuid": "ce13e07b-0ac0-461f-ab08-37880cb26d20", "value": "trynagetmybinsufucker98575.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef56fce-57b4-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638919247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638919247, "uuid": "3b31d768-c3e3-4887-8ec5-86e6af79fd92", "comment": "Malware payload (Formbook)", "value": "8257cfda4bcf7f729bb54f202c2fcbe8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638919247, "uuid": "5275587b-327c-4e2a-be83-9236914319da", "comment": "Malware payload (Formbook)", "value": "b1dd2798d89f66d87e984ac3020a0ddc6741c6a845fa6df3d5e3a27ac08e791d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638919247, "uuid": "d94598ef-d12b-4ca3-8008-409f3f33c765", "comment": "Malware payload (Formbook)", "value": "a92d8320d2c0b25bb519b4186c1cea1bf106c049", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638919247, "uuid": "08ed37a1-ace5-4399-8cd6-573823394278", "comment": "Malware payload (Formbook)", "value": "a764f78d3f15c3e2b745f650fbc1320166566e614ad04e1b651fc8950ed69288eea3a659eda0fd5c29118b2c4002da18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638919247, "uuid": "2d324f6d-bae6-4045-abc6-f485f96100f6", "value": "T16E84BF4D138D7FD5E2861A75408468338CA8AE773E6F85ABEBC74D4F805CDD02275B8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638919247, "uuid": "c34e7077-7319-4a19-a30e-79e7708df866", "value": "7579cd860fab5eb312124f6d9b5cc283", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638919247, "uuid": "18198e2f-c92c-4d99-bcab-014aec96b539", "value": "6144:h/DDAs9TKoUjNVl6tGrFWGDvtww8Yxw7YURz6t776Qgl/u0O0:h/MoUjNVl3rkGDvtww8Yxw7Yf7n0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638919247, "uuid": "5cf0d804-1794-4694-8142-0efada3b3855", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638919247, "uuid": "99c325ea-5da5-4dea-a064-e69a8d796461", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638919247, "uuid": "33655eac-4b1b-48b0-b924-c12d27be9590", "value": "D21349_R01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f19328-5718-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638852472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638852472, "uuid": "07707eef-0fe9-40aa-8d8e-a3132d5c78bc", "comment": "Malware payload", "value": "2381eacc7d9d9c944c4e1b1c92bc6d29", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638852472, "uuid": "9c9c0d3f-a4c3-4d6d-9728-21262dd971bf", "comment": "Malware payload", "value": "b27d56f626c48618d92a7c47b6e3621432f8210f6c0daaa06477afed3ad8923f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638852472, "uuid": "56300280-37dd-4614-b2c8-849eb5d2ce7a", "comment": "Malware payload", "value": "7f87854fa9dd8eb8effb126d7dc24e641d2baea0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638852472, "uuid": "4dcad931-97f2-4723-bdb5-bd92cda3577b", "comment": "Malware payload", "value": "f6a008de0adabd1b0197771d1e98b7b7f0662fcc861f08550db153f5ddf5e0b547028d11bf4a4a3140e42e28c36f9194", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638852472, "uuid": "249b64f8-e7a6-43ce-9d92-cb7024d4fa1c", "value": "T1E7158D1A23EC8F26D2BF1735E8B09A1547F5F407A2A6EB8F6444C4F41D577A28E1036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638852472, "uuid": "4430587d-8687-484f-bd75-d4a0fb08cd27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638852472, "uuid": "1dc9fbdf-482e-4686-b3b6-5c98fed25e99", "value": "24576:SaLeE8m657w6ZBLmkitKqBCjC0PDgM5AK:xVV1BCjB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638852472, "uuid": "d978cee0-adf4-4559-b46e-d25c9bdf4cda", "value": 911360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638852472, "uuid": "78231dde-5aa1-460e-979e-907b6511dfe9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638852472, "uuid": "9499e690-4199-4986-bc73-8409c4722870", "value": "2381eacc7d9d9c944c4e1b1c92bc6d29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc184a0-5751-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638876614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876614, "uuid": "e8003520-73af-4df5-a75d-b902ae3ff483", "comment": "Malware payload (Loki)", "value": "0873c7f6af3985eafe315822eed4aa6e", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876614, "uuid": "04f47bcb-c3ae-4790-bb4c-d157eb507062", "comment": "Malware payload (Loki)", "value": "b28ba5ece1551484bd5b28fbf7e701d03a4cf7969839b98aca47bbb4d6a0b09e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876614, "uuid": "b02467fd-525f-4578-a7ea-fcbfa5bcc7db", "comment": "Malware payload (Loki)", "value": "8c467d276939599c65dff0bff20cb7ee7386f5dc", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876614, "uuid": "f440f1ad-caab-4c2e-bf90-99a0d3bb068f", "comment": "Malware payload (Loki)", "value": "6c688f76dd60f0f5576cd8d208224170e0e1df6c846674c664501ce5b3b0c980e0dd5e9627f912805a01d1b76b4179af", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876614, "uuid": "db2688e4-f3fb-4c1d-bc64-dd6b17e9a981", "value": "T1443412C03482955FD00A96F313B08BD59825CDEFCA21F54B5DE1F60F6ABCA782B1C996", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876614, "uuid": "58aa9bbb-42e4-4874-9dad-64d9410387bc", "value": "6144:FSsskWYmYl7qE2IsGxscPwjziR0PhPgYx36F:wYme72IsGrPwQKhPgYxKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638876614, "uuid": "bd1ed189-5c5c-4439-9b8b-0a807f066e86", "value": 235016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638876614, "uuid": "4bfae31f-010b-4e60-bda0-e4c1eb113f8a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876614, "uuid": "6f7aaf74-1575-408e-bf6f-b63839bb2a7f", "value": "PO-3682036-2022-1-001.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a15cb48d-5752-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1638877294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877294, "uuid": "5cb28d89-8489-476f-b75f-7e016aa8c4d4", "comment": "Malware payload (Vjw0rm)", "value": "a114fe4550c52315ccac4b1fa42341a1", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877294, "uuid": "b0121461-bb16-4fc2-ac3e-7811120de30a", "comment": "Malware payload (Vjw0rm)", "value": "b2cfb719020e4c18fe7978bdf369e5c1fae69dd83260308747c608f4bdd8ecdb", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877294, "uuid": "1cf8d261-6da4-4950-869d-96614fe4af06", "comment": "Malware payload (Vjw0rm)", "value": "cc572372b215e0f17fcfc04170dc3256f345f3c2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877294, "uuid": "8794b0c1-1162-4bd4-bfc2-b1e56bd9cf5d", "comment": "Malware payload (Vjw0rm)", "value": "c59b2dfd9132a05fb2b94d9e71fb097341da8db4fc68c7e6155739ab0b1666816c594fcefe3e7b1d245a4a55ed86de0e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877294, "uuid": "450bda59-a9d1-449b-8bc1-9f9a64ca21bd", "value": "T15AE4231EFD6EC705F2A3E0DA9B099AE0AD35C20582574A09FE4B39650FBB315B1061ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877294, "uuid": "d20e197c-3e04-491f-a550-fb5799d7915f", "value": "12288:7lwYjaNZo6j9Q9//GsNC+JftYWjcQj3v9SMndiYwsNadkDkTnS:5wYjaNZG//tttYWj5hdiFDdkDkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638877294, "uuid": "79eb1949-ae31-464e-84bb-b5139478de1f", "value": 660912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638877294, "uuid": "5f56056e-c87a-4556-89ca-e9baac5cb6bf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877294, "uuid": "4371558c-4f4d-4ae0-879a-b0412463e644", "value": "PO.211071(123).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cbe79e0-5780-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1638897043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638897043, "uuid": "4def4874-c0b6-4041-9648-c10b9bbf3d21", "comment": "Malware payload (SnakeKeylogger)", "value": "382d3b3fcd6891653b2765b50c05ab10", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638897043, "uuid": "a431dfeb-a1a9-4081-90d0-34d020e36de1", "comment": "Malware payload (SnakeKeylogger)", "value": "b3589355b585ea16275aa5eda2dd86c0885da24076e0e4d3108f62ebdc4da881", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638897043, "uuid": "4aae447a-a787-43d6-9b8f-729eeae0ed0e", "comment": "Malware payload (SnakeKeylogger)", "value": "9795b6e40bef68cea61f39e3ea634cfcc560b402", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638897043, "uuid": "54941e92-7444-4669-8631-f694297e3b40", "comment": "Malware payload (SnakeKeylogger)", "value": "7c20102e4ae1a1ec7e7cb8493e21d694c4649da3aa73e9785b026512e64dc02ba906dd611fa0640599f332329c5f7373", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638897043, "uuid": "1451aa35-dc04-403d-ba38-4938a74feb46", "value": "T14913F25F672E585E099670203BA570C3588D65CEE0A11EC0D20E5B3EB3A692777F6EF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638897043, "uuid": "fbafd91b-0c4d-4477-9733-7ca3b01b3b57", "value": "768:krBlk5+a6SjSTvd2qG8U9NXBDDsKnFBV7+3X7Hya6hvnqHsaB6r1tUCqtUDGJ:w45+V82UvBPsKFX7+7Hya6hvqLB2qx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638897043, "uuid": "9359758b-e0bb-4f7c-af84-620f84180c9c", "value": 42558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638897043, "uuid": "8e82d438-cdc7-49aa-931a-8c2bd1b64c5d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638897043, "uuid": "a8e4001f-f33f-4e5e-b67c-729997afd4c4", "value": "signed copy.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427f7b9e-5751-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638876706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876706, "uuid": "00129b1f-b909-4f76-8d0f-b2e61ef870a0", "comment": "Malware payload (Formbook)", "value": "c6889d288d576da53658520ecedfe407", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876706, "uuid": "d6df4c2d-1b3b-48dd-b5e8-04b0270bece9", "comment": "Malware payload (Formbook)", "value": "b4999e6f85c461d92c8fa2edb58f102d183726691cbb0d2a9e6c80b1ae3fd0eb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876706, "uuid": "d8e5339d-b9e0-4ccf-931d-cd2752a07c21", "comment": "Malware payload (Formbook)", "value": "476ec887f54646eaa849b781ce382a8d7429431e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876706, "uuid": "e39db9f6-337d-4743-9d83-27b2cbc4a700", "comment": "Malware payload (Formbook)", "value": "2164c6f1a650b81b2bcb857f3071e97426208318a34ec070a58fcb012084caedec9d9babad41d176b5d30d8755d25a9e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876706, "uuid": "011f5f82-6281-45ee-a98c-a9e73c303f43", "value": "T10C341218B05C64F3D9BB633C2958E9041566FFA3FE06590D2C45323C6EF4DEA2776A28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876706, "uuid": "b79bb3a8-a032-44a4-ae5e-b931850129b7", "value": "6144:F/g02fV4mbQupQ1XUbxNskkPlT7XO1aagNdF8E:F/g0CN8upBbxakkPJO1EaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638876706, "uuid": "5aa51f00-f15f-4cfd-8997-7c3b31a9f552", "value": 234552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638876706, "uuid": "61c310f9-2fa3-471d-a1d4-e38bf41f04ee", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876706, "uuid": "e8f87589-fdb9-4f2c-be3f-fa20a9b302a0", "value": "Scan_Proof_Payment.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98abc718-5767-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638886299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638886299, "uuid": "3292065d-de0c-44a4-aebd-c6312dad7c9a", "comment": "Malware payload (Loki)", "value": "1ed8c5a37c6cc0891bec121aaea97a67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638886299, "uuid": "04648cb1-4b4f-43e3-8dc2-b5941820afd5", "comment": "Malware payload (Loki)", "value": "b52ad386acad7d59ad61fe318733a2b5ad3d9a07eafc17ab0a77c7fe2d8ded8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638886299, "uuid": "8a319b1a-2267-4385-89bd-f0df132ef3d3", "comment": "Malware payload (Loki)", "value": "1bb599c2d3f98eb76ea04e47913e28fc0152a9dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638886299, "uuid": "4cc2790f-286e-4196-9fa3-0ed89b457946", "comment": "Malware payload (Loki)", "value": "b84a98e1351ca0968e0299872d6f4fd4f667795ea3cee4bdf0aa039540e65100f918833015b204d9b216104703442f84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638886299, "uuid": "08ef4fca-82aa-484e-83ce-a4bac003a5f4", "value": "T1FC454A5C317025AFE83A853145540F379EF11C3E966B53CE7317346B8ABE9868F242EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638886299, "uuid": "9e24c363-061c-4b9b-9abc-3c47fc65e88f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638886299, "uuid": "3d39f22a-7f2b-4695-8918-90d52b904615", "value": "24576:hOLso+oSpU/yR9jWQYiHcsFjzeF7lYl+uBA:0Lso+jkQY3sFneF7UBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638886299, "uuid": "11d9e9d1-3cd9-4750-bc00-546f500a4822", "value": 1234432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638886299, "uuid": "4b2ab9db-060f-4fd8-8186-6f80543d2d90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638886299, "uuid": "b37d5f23-7b71-47f7-a3a3-817c2203d673", "value": "DHL Ganderi Bildirim Durumu AWB811470484778-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54be0124-578c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638902077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638902077, "uuid": "b0aacb2d-fece-4841-a7f1-ac5263442c5f", "comment": "Malware payload (Mirai)", "value": "f3e1bad6582e950cc35880f862e7a696", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638902077, "uuid": "88b9acd9-081e-45cf-abb2-941b9a3de78e", "comment": "Malware payload (Mirai)", "value": "b644fd3ab2feff535d0cc70fb5bc70eafaea083c52998ccb4ed70676dd295f1d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638902077, "uuid": "66a6df3a-9c11-4c53-b336-01b1463ecf60", "comment": "Malware payload (Mirai)", "value": "50e247f4d5a964649cce60ada1e423646a405c8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638902077, "uuid": "65617b6c-b64e-4116-bcf1-5ec7b8b37e59", "comment": "Malware payload (Mirai)", "value": "6bacc291ec37bbd2cc730c2a5e09137b36667447135fe3badb46cdc6ab159658248959f87b89c57ea8fdf652014faff4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638902077, "uuid": "6ddeebe8-d0b1-4243-80c4-c4a714d69fbd", "value": "T1D863E646BD828E16C4D512BAF92E018E331317B8E2DFB2239D146F2077CB92F0E67556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638902077, "uuid": "8dfb67ab-c65e-461b-a54c-77ee2b7e4154", "value": "1536:TZn3xRZOk3U1V6V8glRZlWBP/0GX+VQnPPI0iVITdGsGC:VZ9BJGGIdGsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638902077, "uuid": "ba16a641-cdb1-45e8-ab6b-a2e208b90cdc", "value": 70788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638902077, "uuid": "f20cfb1b-b0c4-424b-a133-ea343d70f8ad", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638902077, "uuid": "81b94fc8-7aec-453b-b1f3-4322a65e9c21", "value": "f3e1bad6582e950cc35880f862e7a696", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d772994-5786-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638899407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899407, "uuid": "84813729-eb40-4668-aa0c-432d8feec489", "comment": "Malware payload (Mirai)", "value": "4301c8345fdc32fbe602923a69ba7c8e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899407, "uuid": "c749f3a6-107c-47f5-834e-d6b240131deb", "comment": "Malware payload (Mirai)", "value": "b6b43b1e79e3b0cd8f797dc8d6a7ce64d3064f5c055152566e7425e1a2abfa7e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899407, "uuid": "2dd656eb-b422-4084-8367-79114087faf8", "comment": "Malware payload (Mirai)", "value": "16e6cf685311c28dbb8e3a68c0d096dba81d2c7c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899407, "uuid": "67737089-4106-4313-8cda-81b615a609c4", "comment": "Malware payload (Mirai)", "value": "387685ddb2461a60af37d1589870f93661eace5113f92e733a935431a72749c2b2f346fc88fe4f3cd094dffeb53f87e7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899407, "uuid": "b27874ac-eb93-43d9-b97f-fd818616c6d6", "value": "T11F431845BCD19A12CAE4237AF92E41CD372523E9D1EF7217CC112F10778A82F1EA7A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899407, "uuid": "cb106697-5770-476b-9a36-a2f80a265b34", "value": "1536:D9PcRxxfdqcicMnroYVbJiYOg14Iwwh+1gAL2i0Zec1aRQFO6:DhcRxxiwwEr2itTQFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638899407, "uuid": "fed98557-e85c-422a-b5fb-18c059701f95", "value": 58432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638899407, "uuid": "37ac7cee-b510-4a73-a259-1febd7943ef5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899407, "uuid": "2fbd6f92-1ee7-41d5-9267-b9c241fbb3c9", "value": "kwari.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc3418a-5746-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638872240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872240, "uuid": "a796e9a7-c8e9-4426-b90f-f92e8c2fec80", "comment": "Malware payload (AgentTesla)", "value": "ee51bd2e5c1ba8ddb2391e190d9096e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872240, "uuid": "0d86518e-578e-466f-9344-f7a88c35c3d7", "comment": "Malware payload (AgentTesla)", "value": "b7c60759fbfd268e713fc759ee37b85050a26e88911f6286efead2e427f5c74d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872240, "uuid": "ba542a60-3086-4894-bb22-528f7d47d157", "comment": "Malware payload (AgentTesla)", "value": "6b710708fdf00cc12bbb1e0f2bdf71fdadb20525", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872240, "uuid": "579c7f83-a2b9-423a-94f0-b8e3ef9367f9", "comment": "Malware payload (AgentTesla)", "value": "d2eb1bbfa20b1b1e734a64a71f9ac9360d91a244be82e0836a47765acea175cd034c457e2b8898a2dd8c6d738faf80ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638872240, "uuid": "0383c4db-2532-464f-bcb4-e0219c8440a4", "value": "T18E3533556DD690330C316B6E92F7B8222BDCF87E1EDB913C290A4E09A7B438D554E34B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638872240, "uuid": "3d6ef939-b91b-4631-806f-d8568e3f9ba0", "value": "24576:uMKoAmuAOzDpl1MCFJ5W2My4IK5JEQJlQXBFtaD2:VQmazD1lhK5X23K2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638872240, "uuid": "c51abab2-6eb0-4bbe-91c1-5d9a147d366e", "value": 1071715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638872240, "uuid": "47508f7c-680d-4330-86c4-5d25d0e08f8e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638872240, "uuid": "64fc9cec-9b48-4321-b0da-3ac5a0ad1f33", "value": "00041221.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f0eb17d-5752-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638877290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877290, "uuid": "9097bacd-1d95-4b7e-b701-2e33428e7412", "comment": "Malware payload (AgentTesla)", "value": "d2b968ab1e51bfeb5db60526975075ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegra", "colour": "#21A76A", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877290, "uuid": "115509be-f25a-496e-85a4-e950f61ff801", "comment": "Malware payload (AgentTesla)", "value": "b83b8bc4ca9fc408d9458ba50dfcc350b1827e6331b7c6d456adfc9aea4143b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegra", "colour": "#21A76A", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877290, "uuid": "43799d81-b22c-4472-a481-7e05dac4f18d", "comment": "Malware payload (AgentTesla)", "value": "2cf787ecd25d5b5bb7820f32dfeb1f2029325b46", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegra", "colour": "#21A76A", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638877290, "uuid": "751bf94a-668b-49b9-bdf8-7856fef9032e", "comment": "Malware payload (AgentTesla)", "value": "9de2a8713d848059826055965ac740b058f30ac3f706e95f24ab67dc72bbd3b4b16657dda82aa6ba2130f36c0f4f83ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegra", "colour": "#21A76A", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877290, "uuid": "ab8e1093-8dd4-4cc3-89b5-86b423c7ca2c", "value": "T1033522BD364357CFD99486B13BAA8038227A3E72541BC09CD86E32AB89377057533767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877290, "uuid": "513fc13d-878d-4e57-9761-ab80a27a40fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877290, "uuid": "b3394db2-181a-4787-8aae-a5fcfd0849b1", "value": "24576:SUiL3E9SFYlMUlkTqMxaVGavK7F2NtiQknBkgVZ:/oU9SfBTqM1avTNsQkBk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638877290, "uuid": "0e8fdfd1-8c63-4ec1-b21e-efed77463af0", "value": 1118720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638877290, "uuid": "332f7824-2c0c-4ef3-8843-bda4f4886fdd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638877290, "uuid": "ea34a85d-66ad-406c-9e42-18929e92d772", "value": "Hesap_Hareketleri_07.12.2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06332e8-576a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638887708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887708, "uuid": "65618110-12a8-4e66-a1cd-b1c2e9c8121f", "comment": "Malware payload (Mirai)", "value": "1b3bbd2f91b892db4b92e382cd495f3f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887708, "uuid": "76a0c7fe-9404-4669-9180-401fb7cf2333", "comment": "Malware payload (Mirai)", "value": "b857d28927b9e49735a6140865185ba66d9dcc95f511a7f0fc28ef84095e8a4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887708, "uuid": "d601f2fc-e535-4045-9764-f2ba9163bd4f", "comment": "Malware payload (Mirai)", "value": "54f8ea6ea498f81511fdf62f86eddb592c045f4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887708, "uuid": "9996087e-0ea1-47d9-a65d-0e316ce5dc77", "comment": "Malware payload (Mirai)", "value": "d7f7cdcc7d365e225cee8423e8d09ffa6d7fed1a5b5d4c8cee3806588e1b7bb4a04040f858ba6959117c3d270bffde81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887708, "uuid": "0cc2a1af-e97f-491a-9e74-0ab160e0214f", "value": "T148B31893B800EF76F40BEA7604D34B25B630BFA60E535626731739AB9E761D42827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887708, "uuid": "737a3fd3-52de-4070-8e30-02a62e0f853a", "value": "3072:pKkjsTBygJOCZks5GjbyhwQueZmtf0qEwxOrPp:pK0FgJOCZkdyhzueZmtf0qEwxOrPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638887708, "uuid": "f4ef2a86-a2a9-4604-a7ff-9e58fa9ce677", "value": 116758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638887708, "uuid": "f2a07dda-55fe-478f-8312-6d7e55d84528", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887708, "uuid": "9e644652-d9ed-4535-bdec-94be94db517c", "value": "1b3bbd2f91b892db4b92e382cd495f3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeff26c5-5758-11ec-96a4-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1638879894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879894, "uuid": "4f5552e2-2951-4031-aecd-81da11359b9a", "comment": "Malware payload (TrickBot)", "value": "c9ba05d832190773ceb5be2df4a0cc8d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879894, "uuid": "3bdf5ec8-78ce-4c67-80a4-5bf624ba6212", "comment": "Malware payload (TrickBot)", "value": "b88341c4bb9c3f3c7bfebd5eaf68dadf2da424306f62b2ca82c3f02aa21b8e21", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879894, "uuid": "9753edb8-f587-4e1c-a488-adf8da40b1e8", "comment": "Malware payload (TrickBot)", "value": "343300b559ad705fc709640af741cc53d96c42d9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879894, "uuid": "4d44cddb-fecb-4e03-b5fd-671366567600", "comment": "Malware payload (TrickBot)", "value": "eb1a0df1bb30bd82c309e48dac8f636e3eaebeed4db8ab8d621c835930e7a48e5b6bf98325edb645b79f2945c4162021", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879894, "uuid": "cb4e79e6-1f38-48ee-a8c7-8e8ba9c7cb35", "value": "T1FF8522CD924052FBF36F72C214F99B5B1446157A56310E89D872BAEC8A083FD3D28E5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879894, "uuid": "076f04eb-4a99-439e-9154-00d4a7517ef2", "value": "edfbb86d97e559c057397113f21f48ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879894, "uuid": "d048b0d8-bbe6-4029-a931-a43dfbd4f742", "value": "3072:nsJza4mhuGb3830m0cAHS24Obn2yl7r2ZG7RrvzvkZWyh8ZucKItbKF1IEWpBuNn:wa4wu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638879894, "uuid": "1c925e01-0040-4c9f-862f-ac6b3f0c5572", "value": 1741824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638879894, "uuid": "8c967d59-212c-4651-b90e-3f3d741f8650", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879894, "uuid": "119121c8-2031-4ec9-bcdf-a022bbcd1030", "value": "roben.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd2b966-577d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638895539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638895539, "uuid": "293e9fc2-5378-430a-a8bf-0e7bfcf73a41", "comment": "Malware payload (Heodo)", "value": "77b5b61b1fbf58745784a24a5fbdd701", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638895539, "uuid": "b0733ad0-302b-4622-9940-e8f37c951711", "comment": "Malware payload (Heodo)", "value": "b8bea698d2c1aaabd1b66a04dbffb891042a90a4eecbf84310c5985bc7a21c83", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638895539, "uuid": "dfa1607d-4e4b-46ed-8733-c29eb741422a", "comment": "Malware payload (Heodo)", "value": "006105320dc5c543a9e6c10b9ee53f1bef94db3c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638895539, "uuid": "a7ceff48-f59e-4ff9-b6e0-b4910dee0785", "comment": "Malware payload (Heodo)", "value": "2deb309bd95ab5b5cc184332a0fda88860572837e3211c9b0ddab433257c7f199f96b08613c0c929572b8746ec68b414", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638895539, "uuid": "1ded3432-6293-47c2-a988-02eb76164153", "value": "T115F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638895539, "uuid": "f76df416-46ea-4d97-aade-e873a2b9a80d", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638895539, "uuid": "cc58e0e8-4199-4090-ae6c-bc01890b639a", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/U:JapiKiBEmj4GbOX399Md9J/0TK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638895539, "uuid": "dbf1794a-ea14-43ff-9224-97dec36b5d22", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638895539, "uuid": "3c74d523-e9f0-4166-833b-ea51d20e95b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638895539, "uuid": "5a57cf68-a126-4a86-a72e-029328dcef09", "value": "KfMKl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e61ebc-5773-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1638891343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891343, "uuid": "3762f114-84f9-4f16-afcd-7711eba2a235", "comment": "Malware payload (Vjw0rm)", "value": "7ffbe101071f11f8aac5803111017b68", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891343, "uuid": "14de2622-c33e-4dba-a341-72a9acbf0e3b", "comment": "Malware payload (Vjw0rm)", "value": "b92e1f81e2d7173920660713191630a8c2012e22540d247cc42357163b35322f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891343, "uuid": "fc3d5be0-c210-4fbb-ac71-3522b76bba7d", "comment": "Malware payload (Vjw0rm)", "value": "c5eca7d30dc157d2574d64c50a3c00c74ce9dc7b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891343, "uuid": "2d21b9c8-c4e7-4f89-bcf4-01017d576cab", "comment": "Malware payload (Vjw0rm)", "value": "74a13a2f0658311606db51a775e220b3018cc14eb748369efea92b0805ddc1cb1a7ac4de6e37c6dd81b7c9db2388ee09", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891343, "uuid": "6cbace99-4333-4549-856d-ac5b2d80df97", "value": "T10514F7DCA850E4DDD825E27575BA3CD997E8631BA04153CC789DB3105B72B40C3EEAB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891343, "uuid": "defcab0b-013d-46f7-ab61-377b36cc9d45", "value": "1536:w7qgfCf445hLIUIfGuK7A1YqDD12Byjq5zFh9KKRtig8tc2aNuGPr2LXzBsW8bV5:xd8NTfYrBM4dmzs8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638891343, "uuid": "6bbd25a2-fdf7-4577-b966-0f86b38dc96b", "value": 192601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638891343, "uuid": "aedcbb70-659a-45fb-9b02-c508d3f2a422", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891343, "uuid": "93154cc9-93c5-4301-be1f-05d0fe65ef1b", "value": "SKM_71221.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f0b2c8-5740-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638869432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869432, "uuid": "4d88e7ff-52c6-4667-b7be-56ac4b49391a", "comment": "Malware payload (AgentTesla)", "value": "a24c41607528ade7e0539a26d156b20e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869432, "uuid": "4940fe1b-be90-4e1e-b26a-02092e2f5a7a", "comment": "Malware payload (AgentTesla)", "value": "b9cf4968844d2d15eadd4dd98100fef5c382372432f3cc87822714774aa0a41a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869432, "uuid": "d17c595b-29f1-4842-a310-8d5bc2423148", "comment": "Malware payload (AgentTesla)", "value": "9669b5a8a5a80d7a58ff982fe311ee66df6be25a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869432, "uuid": "c7a77f95-fc5a-43b5-8317-54f69c4b9812", "comment": "Malware payload (AgentTesla)", "value": "147ba9db7f4a5ae3239f325355f09d14663e2ce2f4563461eead58373c48cfc4f796a55ce75145bfb79b1179a48e93b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869432, "uuid": "35e36ad6-8f92-4fa3-ae80-5224e59a7d6d", "value": "T10E8423D721B438D6F42A691B02F4F7F901A1E88FA7B99853DEBD7E184FE21811687214", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869432, "uuid": "a27f4fb2-0500-412a-a9c6-4194cc48e25c", "value": "6144:R87eO2cHtCefsUa8rb2Gh0478WNFkcf6vKd9Gk1E2Y0qLVqDsmVbGUSj7j5Pl0nG:EeRUzG8rb2i0FWNN6uY8E2Y0essobGUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638869432, "uuid": "50ea9bf7-1127-4053-a24a-c8ec308e5648", "value": 384860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638869432, "uuid": "dc631c2c-ddb1-42ff-ba25-0f2094348396", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869432, "uuid": "75fa8b34-2de9-4e97-bcb7-afe042a731af", "value": "TT SWIFT COPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5429c4-5772-11ec-96a4-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1638891162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891162, "uuid": "53ec327c-6608-4e76-a1c7-822edcf47833", "comment": "Malware payload (STRRAT)", "value": "651a47b5e2e3638430e6148e79a7e23b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891162, "uuid": "2cf48b01-5170-4848-a4bd-5f9c9f960ecd", "comment": "Malware payload (STRRAT)", "value": "bb3be9616c4b23e2f5cda17b56b8656a5d71f643fdf545056c97a242b69a6115", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891162, "uuid": "55ec2dfa-bd25-45dd-a46e-9f560fcc59a8", "comment": "Malware payload (STRRAT)", "value": "c8aaea1eaace67c045413c445d17c71af3e8c0fa", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891162, "uuid": "c8073507-e1b4-43ce-aa4e-39432001499c", "comment": "Malware payload (STRRAT)", "value": "143fa6559432952a9e859f2dce133455f8f6a7fa88aa69eb90dff9b75caceb5eaa56ca70a67768216b2fb67c485ff5cf", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891162, "uuid": "2f982873-a128-4164-a303-fcad40554828", "value": "T17754029EEBB981F4E0230CB5691BC131AECE0204D759A35F66FE05970D78CB95E4286F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891162, "uuid": "3b10ec63-0bfb-4b84-b131-16d9b07a60e0", "value": "6144:mVzlhBlX12v2b24eRPXc8aUeFYIPP1kPXc8aUeFYIPP1O:mlxbo2b25PbW+skPbW+sO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638891162, "uuid": "623b6c1f-7936-447e-bd1d-1b2e708586f6", "value": 291572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638891162, "uuid": "09ab06db-c726-46b9-95ce-b68459b608ae", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891162, "uuid": "97352262-ceb0-4393-bc5f-992e425f04a4", "value": "DOCUMENTS FOR SHIPMENTS PDF XLS.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd94e11b-5789-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638901018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901018, "uuid": "bbe75946-60e0-4e9d-a28a-469404f38692", "comment": "Malware payload (AgentTesla)", "value": "dbb39c7c67a5e082546250487439dea0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901018, "uuid": "e44bea43-17ba-4593-9151-8e01969e8fdc", "comment": "Malware payload (AgentTesla)", "value": "bb5a3c38dc06d990b981606dcb9ed9fc0f13f06ac7a08f53bf7ed50d945fc049", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901018, "uuid": "129127cb-2655-40e7-b612-ffa01e306908", "comment": "Malware payload (AgentTesla)", "value": "6ae87c14cb58bcf56162e0474ad717123b802135", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901018, "uuid": "820b81a4-6853-41fb-af61-f2725fbfb42a", "comment": "Malware payload (AgentTesla)", "value": "9556246e7bb5f117fae6401a19f3d6aaf0783f91851177a92b860ec3c2f8fb8a704364dc86fed59599b718c53c548345", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901018, "uuid": "b7c482dc-19fd-438a-9b38-00ff3ba23428", "value": "T192B41289F6988167C7E4B0380FB2CAB813365E9C1194175B67E43FAB3FFE467041A199", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901018, "uuid": "582f81ce-38c9-4917-8df0-78960be89e65", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901018, "uuid": "aaf7ce3b-8148-4543-a29e-0bfabebe4a0f", "value": "6144:+GijF5jKU4ecRKTrNv2bKPkZsPZhvebhK5KgaRFM8OQwp+se0Ix3ZqkZtSeQ:S30Klv97D2+KHRKuwze0WIYtS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638901018, "uuid": "163b4767-5c08-487d-b984-1a0a7ebc21c1", "value": 533088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638901018, "uuid": "174f8753-6486-4cb4-b97e-9416ab67fd8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901018, "uuid": "0c2da7df-b87c-4f84-9e9e-293eb6d3b867", "value": "Payment Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b445682-574b-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1638874143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874143, "uuid": "7d938329-3dec-4d39-a7ec-b285dded6a7e", "comment": "Malware payload (SnakeKeylogger)", "value": "b39ebd7f3b8e407bdcaf2c7351ad8ae0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874143, "uuid": "2d45642a-a2f5-4aff-b56f-ce104ff0cbc8", "comment": "Malware payload (SnakeKeylogger)", "value": "bb5aa33ec1181af72cf4422a71bbf8a7d594f4c9522e3ed91f0a241609ab530f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874143, "uuid": "1cef7e36-8262-4505-9d7d-b2219ea2a60f", "comment": "Malware payload (SnakeKeylogger)", "value": "b4992a53a9d2e624d1fb2427ae712c5c0b6ba916", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874143, "uuid": "6aee423e-b649-46a4-8244-d8af99b6aeae", "comment": "Malware payload (SnakeKeylogger)", "value": "720baf171ca0d34077fec33d641a8e13c67f133f3a3c1997e36a7de9ee2dbe34e4faa7c9706d94832af8ea004fb9720e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874143, "uuid": "c5796bee-bf65-4045-a711-4145a6b623b8", "value": "T12415235611D68FBCD7BF07F054B8119813B6E003AA21D75A1DEEB9C62D677C8CBA0A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874143, "uuid": "49b329d6-95e0-4ddc-88d3-3e8a5ae710d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874143, "uuid": "03f911b4-7a6b-4fa1-980b-9243d28c7cd3", "value": "24576:FgDsYuOoDh7K7Hq4wGnhJ/FvW6F4bq+H70N7:FgQYuOoD5CmGY6uG270N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638874143, "uuid": "812de4f6-a981-4a05-bd65-15bf4421d063", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638874143, "uuid": "1a24c0c5-89e2-43fc-8f3b-5c64e73e3f29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874143, "uuid": "7e6e9c88-74ac-4d24-909b-658b827f942d", "value": "payslip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a5acb14-5747-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638872316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872316, "uuid": "acf39da5-1a06-4441-b31f-d130c8a9a5ba", "comment": "Malware payload (Heodo)", "value": "d5957581b71ffbbe41341ae70a948b46", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872316, "uuid": "87999f28-0bcc-4fb0-ac4d-a0cb06c771b1", "comment": "Malware payload (Heodo)", "value": "bb5e7a72c0ef4e745eaa2461adf3585536074942ea9a065a14342b766f341b47", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872316, "uuid": "9736d805-d57a-4fd0-a112-f32e0bae9e5d", "comment": "Malware payload (Heodo)", "value": "16bdd87c08cb72d6f3def5ba44fbb72e5c417290", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638872316, "uuid": "b952e96d-7470-4da0-804d-b5a1096be068", "comment": "Malware payload (Heodo)", "value": "82d818d744b28231485575b84eddadf8f7e0799207b873c4c3576235992703f8252e860a82ca8e60b8fa91eb5f8c2094", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638872316, "uuid": "42131b04-94ba-467b-93ca-142d69826b5c", "value": "T1CEF48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638872316, "uuid": "df281008-762c-4c40-9c80-c5740f27cd2d", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638872316, "uuid": "14d183f1-6632-40e6-b0e7-da67160f9bda", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/8:JapiKiBEmj4GbOX399Md9J/0TO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638872316, "uuid": "d49bca9d-56ac-4009-a734-96038b7d9266", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638872316, "uuid": "8075a06f-104b-490b-a1ae-9b2160db734e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638872316, "uuid": "73f3c17b-8591-434a-bfc7-fe1d7660dce6", "value": "oovselZw7lW72Y.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f68c3a26-5743-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638870995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638870995, "uuid": "e5a686cb-a30a-4248-97d2-e118e5a7dc2d", "comment": "Malware payload", "value": "c73f4c8949a1c076ee520c8f9c994ad3", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638870995, "uuid": "9c318c09-a1f1-40f8-96e3-23f9a899ed2d", "comment": "Malware payload", "value": "bb72351931f05d126f6153d2d84f9487437934f11f7db1fb72274080e07fe5fa", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638870995, "uuid": "babfd26d-20d9-4412-97c6-a166fe4f8d62", "comment": "Malware payload", "value": "98001392b96d3e6a50f05334e6b62d823705bf05", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638870995, "uuid": "1de34071-f535-4d9b-874c-dcf99c4e5866", "comment": "Malware payload", "value": "d5aeef88c4a640c32602386407530bfc6bf1d59441e83b1e20f5a0b4a57573d8acb650aef6c0c0e2ae02ad7641dfa399", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638870995, "uuid": "657c76a8-e30c-46a9-a170-59458e734d64", "value": "T10FF42339D7ED79142405BED8C541C6F5AB67C10BA9DA7F227BECAC4B902683934F8048", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638870995, "uuid": "8675e908-b38b-4214-a5be-63c3a53391ca", "value": "12288:WNj2Nglg5R88wN53q0iaczFPusAsJ92ZsnD7NUqwen/R5Km4dvNzGrHMwr+QmN:ijoGN535ifFGsAs+anNUXend6qM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638870995, "uuid": "aeae7f2e-1433-47fa-8bd6-ea3138c187e9", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638870995, "uuid": "43b7549b-038e-436c-b012-ad4e0327a4dd", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638870995, "uuid": "83ea2344-83e6-4b29-8a52-0d160532a94e", "value": "bb72351931f05d126f6153d2d84f9487437934f11f7db1fb72274080e07fe5fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35bc7a28-576d-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638888710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638888710, "uuid": "b8cf096a-3b2f-4c2c-815c-24ba074b3a60", "comment": "Malware payload (AgentTesla)", "value": "77f89266abefd94f3c91d3ab6c43ca23", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638888710, "uuid": "df87fb3f-20af-45dc-a309-c4aafb8beb01", "comment": "Malware payload (AgentTesla)", "value": "bdbb232c5600efca14367c9830ed7308e3b3f06c690d0536905a6bfd2a6c2980", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638888710, "uuid": "a86a5130-f809-4fa0-8ce2-9a9f77ff9e8b", "comment": "Malware payload (AgentTesla)", "value": "1d74666b8e32a81797eee439ee27362cf408d1d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638888710, "uuid": "4b52fd22-c59c-4aa2-80b2-4a0ab7f1c84d", "comment": "Malware payload (AgentTesla)", "value": "4a12c7206560aa202c92a7ce41ca0b85c688cb38d599ba034d6263a4d2b63128b020a1a96adb423eda2aae4c3bbe3411", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638888710, "uuid": "5d6769dd-bbbd-4026-b58f-cb7f78c9a3cb", "value": "T1BB3522AC3A9367EED29583783725917453B6BE721053D28DE499358F0D33B407A73263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638888710, "uuid": "a70993c6-3f16-402f-b03f-99a8d8ac08bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638888710, "uuid": "ce79a3f5-ab6f-42d5-a56d-0d2281a1f082", "value": "24576:GD9lAKrO6M5bAlTc7/QJxRWto7T35FfKOOGG:G3M5cl8YXRWtofKOOGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638888710, "uuid": "78260514-651e-4b16-a973-67150f47c510", "value": 1104896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638888710, "uuid": "4ac78aec-b9b7-47be-b326-bf4c123ea09b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638888710, "uuid": "59150eca-4368-4243-9839-d416a386ccd5", "value": "callyzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bdb86e3-574a-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638873634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873634, "uuid": "6bce5b35-1756-467a-9fb4-a3e6c61a87c6", "comment": "Malware payload (RedLineStealer)", "value": "7d1e92c70f96d0d007d2dea26aff4da8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873634, "uuid": "de7f938d-634c-4935-a9aa-d649e6de7494", "comment": "Malware payload (RedLineStealer)", "value": "bf179693e787a960583dc431e1227b1d2b6218fff3fd4c76167856d38d4e33f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873634, "uuid": "148a6ad5-edbe-4eda-9277-7707738e8254", "comment": "Malware payload (RedLineStealer)", "value": "015bb66529ec4554f210bbb7df4e597efc77dca6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873634, "uuid": "d5a06b29-ea78-48b4-be62-77fc40b0d546", "comment": "Malware payload (RedLineStealer)", "value": "9f8d8a9dc42ec26186abfae3b40e9d55496bde3787e96eda985f4baccdffd7f866c3dec07550d89bd9fe74d3e1be4b48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873634, "uuid": "9171ceb5-6e94-440d-8822-61b4a0e78231", "value": "T12CB4F63839FB5019F2B3EF759AE875A69A5FF7633703A51D205003864A13A81EDC263D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873634, "uuid": "1453522a-ba77-46d5-b809-7fa0c6ca9376", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873634, "uuid": "f04a5865-9365-4531-8aa6-4e6defe90410", "value": "12288:RSl+7KutSfdxR8uRSuvHL1811+MO/femS8TYb5pgexm:m+7KutSfPRPOI25l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638873634, "uuid": "cc2cfd34-3fc1-455d-99c8-06b2f8743778", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638873634, "uuid": "3e58cf2a-f062-4708-8c21-4470c024fa64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873634, "uuid": "8d144cfb-17ca-47c5-a9ba-3a5c69d6b758", "value": "SecuriteInfo.com.Trojan.PWS.Steam.23280.4700.32011", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db2df71-5722-11ec-96a4-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1638856484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856484, "uuid": "a9d226ec-c68c-49e1-9b7c-f342482add08", "comment": "Malware payload (Amadey)", "value": "2a03cd34f26826a94fde4103644c4223", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856484, "uuid": "cbb9e158-631f-423a-a937-3a04e6de3083", "comment": "Malware payload (Amadey)", "value": "bf5b55dd90d317000bdbdc2eb08bb3ce3c0263cac10aedb67d65f01fd39c95fd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856484, "uuid": "eb79de95-b923-4aea-9f8a-4d8f105a8c48", "comment": "Malware payload (Amadey)", "value": "b86cbf66e1087ee7e0fb5244e3a046e5aa3fdb21", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856484, "uuid": "4e763fcf-dde1-4038-8349-5ee3175ea3a5", "comment": "Malware payload (Amadey)", "value": "970588c4de7cfd553951a28946f072e2e06fedf26923fad46b8f12a5a4b415c44124b99ceed3b046823487b2a3136f5e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856484, "uuid": "0da6fe23-4336-41be-8ae5-96b3b7f39d1b", "value": "T18B74BE1172D0C032D09624768925DBF54EBEB47166275A8FBBDC1BB91F347D2AA3230E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856484, "uuid": "89d586a6-0bc7-4fe1-825d-70c411d245b1", "value": "d661587f40953a8f9407bb1324edc945", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856484, "uuid": "959f2c56-3979-4db1-96f3-784acf498e1a", "value": "6144:f3eSfu9er5zmFdbDD5LsTizFWCy7k1mv/I8872LioPRoJ:f3+9GzGDdLcixWDNHUyL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638856484, "uuid": "bf58d532-f0d4-4926-b423-57e6c2244ac6", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638856484, "uuid": "ef3499e6-c1e4-4b1b-8cc3-6e44dcc993f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856484, "uuid": "1805d675-672b-4c4f-ae38-5ada8745aefc", "value": "2a03cd34f26826a94fde4103644c4223.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f8bd5e-5704-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638843726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638843726, "uuid": "74ed6fd8-f96c-44fc-aee7-eb3f86120576", "comment": "Malware payload (Loki)", "value": "d1279da0ffbc04887863ac95a894f275", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638843726, "uuid": "e6f1920b-dcc1-4c30-bf7a-123ed5f26a46", "comment": "Malware payload (Loki)", "value": "c004cf20f130b80a6a52e8999ed94795d1fd9f8ae35ccda173bcb2cbeccf3888", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638843726, "uuid": "67c94040-bcac-45a4-874c-74bbdb9895ad", "comment": "Malware payload (Loki)", "value": "b0e8eccb61fd44315e03101ee0084367a8379295", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638843726, "uuid": "d489f6f4-b7fc-4e62-a2ea-5efa524eac7c", "comment": "Malware payload (Loki)", "value": "770f374694c83cadcd2846be61e17f37cbcc71178ed0246f50d5774394feaf9b19b02bc5d68fcd7210f400aaadd72c29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638843726, "uuid": "b13111f5-116f-4510-8847-2417340250ba", "value": "T1E9C402B0156ECCA0F80DC17C822D7A3A6AB6BC221951C2FC1E55BC658F37251EE71A76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638843726, "uuid": "b218856b-1882-4f62-a235-825122bf4a62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638843726, "uuid": "b453a78d-0118-4207-8f73-29a68981e0f8", "value": "12288:HFXIR0itWEYedYsEdC6jJ3str/uNtml8xw19x:HVIAwYsQJ3str2mlAwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638843726, "uuid": "4c614fd3-2bf1-4c96-88c7-e250c3e35b48", "value": 556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638843726, "uuid": "3e7882d1-b5e5-45e0-874d-0c03c263a1d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638843726, "uuid": "d8785e58-7fb2-4520-8a06-5d8a0296f4b1", "value": "d1279da0ffbc04887863ac95a894f275.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c063053f-5769-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638887225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887225, "uuid": "34d652af-6149-4213-bf4c-078670b2ad33", "comment": "Malware payload (Mirai)", "value": "249e0da46fb60fae19fd548d66f022b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887225, "uuid": "2549ccb5-6021-404e-8600-c0f9b59bee15", "comment": "Malware payload (Mirai)", "value": "c0788c4b6d17c62e1e0492af2c4cbec60aca1593e4b7d5174dcd263ebdb2e0f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887225, "uuid": "6d7aa9a3-4760-4ab3-989d-bd0752733959", "comment": "Malware payload (Mirai)", "value": "796c8e819c70bccfcbee17ea7eae7233e0220105", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887225, "uuid": "95623508-e821-4be6-b720-b4c6be5bed13", "comment": "Malware payload (Mirai)", "value": "d52af70261f781d1a985054114b43605d9669d72cf72949776d3c537ed36080fded66c3c4d26a4b39a713c7ee73d88f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887225, "uuid": "e4a321ea-6305-4155-98ae-f622e9ca08da", "value": "T17013F1EA78584DB1CE22103ECEBF164E3FD6886ADAEF2520A472D100E3474465CB57D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887225, "uuid": "ae0b5f83-8c16-44fb-a5bc-d2717628219c", "value": "768:6xugsk7u78l+HyRYrh3kCAjPWs75b45s3UozY0DQO/XcHu:67feHyRYu7PWs9bzYHOf2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638887225, "uuid": "b976fc5e-302f-4931-aea5-4248da061eb5", "value": 41756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638887225, "uuid": "9dd595ac-58fd-4728-a378-4473dfa197b6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887225, "uuid": "164894c4-d94d-4025-ab4f-4bf873cc2ded", "value": "249e0da46fb60fae19fd548d66f022b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf805df-5774-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1638891997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891997, "uuid": "d26753b1-098c-49dc-8dd8-f0c33df2613f", "comment": "Malware payload (RemcosRAT)", "value": "7243c933fc6f629d2efd40c5a8ff8e7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891997, "uuid": "c184df1b-980a-4fda-851a-ca1e4066fd2f", "comment": "Malware payload (RemcosRAT)", "value": "c0c762ca6f6234b32a2a52b2dadf5b0d35c935a56b6676a9da92bee2fd3d7a6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891997, "uuid": "da087011-608b-4507-8fec-2e07bb065bea", "comment": "Malware payload (RemcosRAT)", "value": "5446b6b1e25f13821381476b876f4a6cab4043aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891997, "uuid": "a86ea23c-53b5-4be0-b333-0549fbffdda1", "comment": "Malware payload (RemcosRAT)", "value": "7ccf1193c8d592f030e8bac88d6a2d275eb0cc7212181c896cfbafb83d5a7a35327ec04422a607a2a0cb3591098d36b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891997, "uuid": "73184f19-f54e-4287-91a3-4a7353a52352", "value": "T19BE30812F5A0B406F21685F06825A36C6854FB7D7770A9EBB3B5BB1910322CE11B5F2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891997, "uuid": "4e1e2acf-468e-4fe2-81a6-36139c4af711", "value": "51127e9f9b7ace209c6642a5c0586a83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891997, "uuid": "bf2740af-eea6-4aad-b1d3-1952cbf83d08", "value": "3072:lZhGffOVvFJfImRoYiO9v9ZpAMksH1A8iBl0EgF30vRgb:zAfivFJ7ogbAdsH1A8iBl0P3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638891997, "uuid": "1ca2d1e5-88e7-40bf-89eb-c8c90d885ccc", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638891997, "uuid": "a9af4eb4-8b02-4001-a29a-5264faab8721", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891997, "uuid": "6c05b6ab-c323-4dbb-9461-67bbe43e2614", "value": "7243c933fc6f629d2efd40c5a8ff8e7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c5306e7-57a3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638912021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912021, "uuid": "19f7ff82-c8bb-4b17-9d1d-2215907bb2bb", "comment": "Malware payload", "value": "20b8d470cf139fd49e10d19c6d6237cc", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912021, "uuid": "680fe243-b01d-45da-a776-aa3cfdc5a1be", "comment": "Malware payload", "value": "c10aa336a5e674a3f81339f7aa2436083391c3897a77a4cc6f1d2746f2ba5a3e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912021, "uuid": "f746c2f8-9afd-4a74-96e6-dbfd050d4213", "comment": "Malware payload", "value": "6c48b8650db003fec1072b192408b410eb89b09e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912021, "uuid": "b14c6a2b-0aaf-4ffc-b7e3-6314dbb6b20d", "comment": "Malware payload", "value": "877aa24b6e2fa1c454bef8fd347c6e1379324faacbc022d3bd7bd635f86f9918dfda582fac2bf8a1525edf51bc1ff796", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912021, "uuid": "ab7a346a-ced0-4dc6-83ae-ac308fd50eed", "value": "T191D37D38A2D1B4A6DD9A01334643CAC977722D5BA591836EF2253B0C7E70AB8DF31F15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912021, "uuid": "5b8437d6-ba77-4787-8f29-e970158e3ce6", "value": "3072:7IzVXID32D0Me9kxMFvZUe6ohEQ1Jo0F6c:uyyALkSFvCe6dQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638912021, "uuid": "ff7e2433-a900-4f62-b99a-9fdb4f6d4862", "value": 139776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638912021, "uuid": "40336798-f06a-4d4b-b7a0-24856e4f9fb6", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912021, "uuid": "3e6dc03f-e9f7-4185-92c6-56f3bc57657b", "value": "build15.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55dbf0f-573d-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638868389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868389, "uuid": "c45ce0b9-53c1-46ed-a54b-921653b476a1", "comment": "Malware payload (AgentTesla)", "value": "f4ceeedf2db21604a2906a957eb6bc6a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868389, "uuid": "e50f7a05-8a5c-4ef3-b03b-a7391ad49d54", "comment": "Malware payload (AgentTesla)", "value": "c17d238f71bf59f09e62ad28603e2f2918c9300c52eaf2feaebcf53818dded2d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868389, "uuid": "1db899ce-03d9-425e-bdd0-285086df7505", "comment": "Malware payload (AgentTesla)", "value": "a30592360e8f6a8870e05e3db0486578af6a2bd2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868389, "uuid": "ad04abc9-2cd3-47f4-8a6f-7cf4c1d16ebe", "comment": "Malware payload (AgentTesla)", "value": "b1666c2b14226a30cd8fe15737c475dd98db4eb97e4d2c1b9523b68df375ddf6dfe1f5e0a77da66a13b46ae47afd5b86", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638868389, "uuid": "5b8a795e-5fea-4b11-837f-e1fcf2565a80", "value": "T1FCD423002969B8BE409532D03B021DE96963B88F7D873921E2DEB15F3ECB1E76739543", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638868389, "uuid": "9e0c87f5-b235-4ec0-96c8-e478d16deb64", "value": "12288:jV07I0tCS4YZOuQDoWuftmgrD/AJ1+hJhuR1O/jZrG1rycElmaRKDfO:jdutUuOZuIgrD/Afohu2jZrG1ryPF0D2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638868389, "uuid": "efcd3b60-e5c1-42ff-b10e-55bc16fe3971", "value": 642934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638868389, "uuid": "5076d859-3ae2-4ed5-9378-02d79457f257", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638868389, "uuid": "9917a715-4f61-444d-9b61-32206fc217bb", "value": "statement of account.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12655336-5740-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638869323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869323, "uuid": "f4b75742-83ca-43a6-b026-66be663831c2", "comment": "Malware payload (AgentTesla)", "value": "267405badcc860f3ac5a8a3537a56231", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869323, "uuid": "42418280-011e-46f6-bfa4-5cebbc1b44c7", "comment": "Malware payload (AgentTesla)", "value": "c287312fb488a63e19e97ea3257f880e0be5067c411aa87e8aa409cddae2dcd1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869323, "uuid": "edbb979b-0759-4b27-b4c9-c923d38e2716", "comment": "Malware payload (AgentTesla)", "value": "b351976864972a98dcd800280273bbeb01bc6cfe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869323, "uuid": "2d4beecb-e133-49d3-8d41-75b6ec9df38f", "comment": "Malware payload (AgentTesla)", "value": "1f40fa2e587bff859927ea90e80dd1c6ce674fd93c6a8eac4797a1088c926ec2df1b6f143f6cde6a501f45c13606ea45", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869323, "uuid": "0bc01790-fee6-4df3-815a-7434098f295b", "value": "T1228423D721B438D6F42A6D1B02F4F7F901A1E88FA7B99853DEBD7E184FE21811687214", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869323, "uuid": "82b3245f-30b8-46dc-984a-2ac2989d4672", "value": "6144:187eO2cHtCefsUa8rb2Gh0478WNFkcf6vKd9Gk1E2Y0qLVqDsmVbGUSj7j5Pl0nK:oeRUzG8rb2i0FWNN6uY8E2Y0essobGUO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638869323, "uuid": "30de4829-40b4-4dc2-a017-dadbb4bf80f3", "value": 384874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638869323, "uuid": "dfccfe41-5379-43f0-b8b6-f982a520dcea", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869323, "uuid": "ed545ba9-4d66-4896-93ce-3517d194bdbc", "value": "STATEMENT OF ACCOUNT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f7479c-573a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Alien)", "timestamp": 1638867123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867123, "uuid": "011df7d7-487d-4f25-835e-4b8fe9e73651", "comment": "Malware payload (Alien)", "value": "6365e05d01abc00295d40826ffec8388", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867123, "uuid": "b4a9f7c4-acdc-4e01-8dfb-e2bfec1b1d32", "comment": "Malware payload (Alien)", "value": "c2ea0cee960e500ffb9d7bb46d5a2272765dcf9afd55e4e933232c8d33d85295", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867123, "uuid": "9135d5fd-4082-42c3-b363-024ffb601071", "comment": "Malware payload (Alien)", "value": "87723c64205336b8d13859ceeb3be672d7a1f51c", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867123, "uuid": "3994b50a-4e0a-4f6d-b011-bb34fb1bde74", "comment": "Malware payload (Alien)", "value": "b417301c01139afd609f7c7994263c747658ca95f05f61c92fc30524ed1b0f8483a47ecbe569e456dcdac8a7cbae2267", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867123, "uuid": "11fe3d23-af1d-4e6d-921e-eaf8501bfce2", "value": "T10E9533950C00A479F2F5C7312A978A52B0F8196843A2DDEC7DBF70560BB2B942FADC75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867123, "uuid": "5b2bc324-ec8a-4c32-b6eb-ef69cc7cb83e", "value": "49152:5CQXnOZAsxVh6bZkurB4gK88usQe7FY7WPteyY5:YhAMVouurBVK8PXe7C7WleyY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638867123, "uuid": "74006b10-b628-45df-a66f-30a8d1a331dc", "value": 1937999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638867123, "uuid": "3c275b31-9f9b-4e1c-a5b9-a141c8d18d6b", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867123, "uuid": "cabc07ad-3b5f-402e-bd2c-efe65cc52dc2", "value": "bundle.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea8a3256-5766-11ec-96a4-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1638886007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638886007, "uuid": "c9ac49cf-cecf-4907-b55c-e81f4d146ecc", "comment": "Malware payload (Vjw0rm)", "value": "cf4ec0d22c787775c9f46dd0fe19da33", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638886007, "uuid": "0d3ae166-6b3b-4182-9413-253c8dea79cc", "comment": "Malware payload (Vjw0rm)", "value": "c399dbe473150a5d2a9d3676d81971de66f2daf5360d2be26e62b5533c4fcbad", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638886007, "uuid": "233d71d8-7d89-4091-a0ef-57b3b751e607", "comment": "Malware payload (Vjw0rm)", "value": "f0379f9363c0c9955d9b71064a2879fd6b1cff5c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638886007, "uuid": "e61cf279-badd-40cf-ac9f-0271c42ef68d", "comment": "Malware payload (Vjw0rm)", "value": "519cc62478b92b19d86b5937ae438a72c15d12c62f6c0f985b32ce50a8c677d07db9332f6f2269b9867e5894f85d2fcf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638886007, "uuid": "edddf560-23c4-4fbb-90d8-4b4ddaac4187", "value": "T188C46AAC7940F69EC826F634707A38D99BF47A0B980153CD786CBB005F7A640C6DDAB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638886007, "uuid": "a362f75a-9eb6-4489-8cab-05f357b2f0a7", "value": "6144:Bxe955dSf60HSsSk0G1DPZffb/FDawxQ9jmoLAdpwnaDTaHIkvIlo72fW+KFWFZ:cSxysS1GFBfTcZnLbaDfkH72fYFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638886007, "uuid": "cb245e42-b5b8-4649-b3a6-4ae3797c00ac", "value": 544741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638886007, "uuid": "7c08b7ae-3e91-443f-ade9-8cdf451e46a4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638886007, "uuid": "658785c4-533f-4749-8b25-df2ea9bec79e", "value": "SHIPMENTDOCUMENTS PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f96228c-5763-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638884485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884485, "uuid": "f5ce199e-6156-41ed-9fd0-1fb3935400b8", "comment": "Malware payload (Loki)", "value": "8a70073f811f675c0f2ccff5af631e4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884485, "uuid": "05bf342b-865b-469d-8a20-0eff05fda094", "comment": "Malware payload (Loki)", "value": "c3b1ac882119ac598f2040eff35c37f17673d080bde463037e153df714b60c77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884485, "uuid": "47f18b8f-f63e-4531-862a-cc261aabe485", "comment": "Malware payload (Loki)", "value": "1b8721f63631def730af95d3b173d74450992dc4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884485, "uuid": "5d6ae940-1631-4117-be1d-d9637377a4ed", "comment": "Malware payload (Loki)", "value": "f71ea90aec927cdc64c243175c83fc9d581057b69766bbd9f9731a7247f7c314733324844da5018350cb580bb274e797", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884485, "uuid": "31aea55a-30f2-46aa-baee-069408b8365a", "value": "T1C845395C313025AFE83A853145541F7B9EF12C3E866B53CE7317306B8ABE5868F252E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884485, "uuid": "1cd18a75-5db2-4c85-a769-4d7d1db339ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884485, "uuid": "a6fcfcfd-0618-4686-b397-65f70003db62", "value": "24576:8Lyj51vTcaicMw4zJinUlW41nOZP4KWH:8LyVy1tPiUlFMmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638884485, "uuid": "1f374850-a9e4-4181-8f79-180929f30049", "value": 1213952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638884485, "uuid": "4f3614e9-076f-45bf-804b-e0f305177d31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884485, "uuid": "df406111-d63c-4caf-b6cf-6b23f1b7627b", "value": "8a70073f811f675c0f2ccff5af631e4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2e134f-5777-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638893204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638893204, "uuid": "785f0465-ff2e-43b2-8f0b-7d2bb876d0dd", "comment": "Malware payload (AgentTesla)", "value": "31b51006f4ead5e9f3a9627596d5c322", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638893204, "uuid": "517b6dbe-c89f-49f9-a023-0cbeafb92cd3", "comment": "Malware payload (AgentTesla)", "value": "c49dcf55e5c667fb8056d8893738064b453c39cb8d8b6c893ad879567772e039", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638893204, "uuid": "40ecaa33-6ea4-4960-b708-0ef1312142c7", "comment": "Malware payload (AgentTesla)", "value": "2bdbc91d8fcda0fae89b7183847cd80528f58b64", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638893204, "uuid": "ba52040f-121b-416a-b7e8-3bdc9a53ff12", "comment": "Malware payload (AgentTesla)", "value": "ecf769c9a3b74f9068919ed43925158a42dcbbd0ced7d6c635778ec79d92f9858b2aff5450e979dd312ccccd4358a6a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638893204, "uuid": "5e29f782-dfc7-4728-b8c2-de9ead7c9795", "value": "T17835127D369356CDD65697393B39407852B27D37491BD18DE82A368F4A3BA803A33323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638893204, "uuid": "cf6e8239-0cc4-43d8-90e8-4851a1002783", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638893204, "uuid": "7ec81282-54ca-43bd-b3b6-9babd2c91ae2", "value": "12288:tlB/BLjgB9+rRBvYKj6JSA0XwfTnumm8cSnstyrL1m7/FjAPrbO4gw00ayKoP3SG:tTBgBgVBdfAf6mJsEdgJaqw0ISf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638893204, "uuid": "93c2c2c7-1c0b-484c-b4ef-de50337742fd", "value": 1074176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638893204, "uuid": "011510c4-c55c-4dd8-a6d6-3cd404e8ce77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638893204, "uuid": "60e08485-9b6d-490e-a14b-d7e97535e638", "value": "PAYMENT CONFIRMATION.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87006826-57b2-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638918482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638918482, "uuid": "8b88d617-0131-42c2-bc61-949f3c6188fe", "comment": "Malware payload", "value": "dc0a90f05b01fc09f894d4f4bf6c621f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638918482, "uuid": "93221833-376e-4089-9f17-1859855ce445", "comment": "Malware payload", "value": "c4a2d749d46cd39aa170e4bde65679d72937c3f2b53d925588f62fcd7b71993e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638918482, "uuid": "f7280b8a-455e-436a-b813-c589e5cf7ca4", "comment": "Malware payload", "value": "70de839d8e44a3fd9421a52425fffcb5d59fd1a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638918482, "uuid": "2f5abb3e-93df-420a-800d-bab638fc441b", "comment": "Malware payload", "value": "9b975e9b971920c2cc0d727f1d0d9dfd554a561459e7ab0d2e932e8bf7e6192e3c37c199307f92f47f5cc9e3ae64e9ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638918482, "uuid": "f1184ec7-c7d8-4413-9576-3fb40f7bd49f", "value": "T1A4542C8127C4C60BDAEFAEB5EBE12D7803717CD85E11D39637486F943C52286EE31692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638918482, "uuid": "bf996939-7745-4d4e-87e3-e1522bc1ec27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638918482, "uuid": "db84f207-c1b2-4d1c-9377-a027f8da7db5", "value": "6144:sqQDhqYPR4+n1XmnHRd7urEKoY2axlZlkvbV5Eh:sqQAYxn1XGHRd7aEKoSTgEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638918482, "uuid": "cc0fbb07-07e1-4e70-9762-975fb694b680", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638918482, "uuid": "9ad78147-134d-4666-ba82-a6beb963940c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638918482, "uuid": "0f9b6976-b1b3-4f6e-9cba-c14daa72cf6e", "value": "dc0a90f05b01fc09f894d4f4bf6c621f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "666e8548-577a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638894375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638894375, "uuid": "e778d20e-dc35-4f59-9ddf-41d46de1a647", "comment": "Malware payload (Heodo)", "value": "1593d91c50af494567f069bf2955737d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638894375, "uuid": "67181d51-3662-4efa-b3bb-95f148a8846c", "comment": "Malware payload (Heodo)", "value": "c52d2c079bd342fee63f3a3a42ef30b430ad0a54a6059339b2267e96160cd6ce", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638894375, "uuid": "2d593ae5-16f5-44d5-9dd7-fbc5c784bd9f", "comment": "Malware payload (Heodo)", "value": "f26a1a8ef1119f031839b0314f5c41b2cb32c6b9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638894375, "uuid": "cb6e65e9-c276-49c4-98fe-338ce86a2290", "comment": "Malware payload (Heodo)", "value": "642d7be8fae2d744061a666a124bd17f8a982800e78ab7e7a209930e44352a22ec8b8f9bb9b74619599f1ef648b011be", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638894375, "uuid": "99b1929b-079c-4180-88b9-14221ff9feb6", "value": "T19055CF043D8180B6F92724391238B7658FEC69210B30C9DBEB94ED7D5E25DE25A3E1DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638894375, "uuid": "29266d19-f7b4-4d7a-9520-875357819fe9", "value": "ce5896fd181bed8a87ce7f299693cafa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638894375, "uuid": "b464fb38-c278-4d4c-8a5f-dd21df4777a1", "value": "24576:a/eZY5g4b9/LwRMGS9sBS0EPG9RIOyp+PB9b12mehjfhfyxI+tORocluvCqknhWF:Nihwm98f9RvPXehKI+t6zci17oN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638894375, "uuid": "43f81bcf-aeb5-4e75-b81d-389f3980ce2c", "value": 1355776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638894375, "uuid": "a4275925-8aba-4193-b701-0c2a293f7c72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638894375, "uuid": "e14ea478-87dc-4ea4-9146-e29fea4f1550", "value": "emotet_exe_e5_c52d2c079bd342fee63f3a3a42ef30b430ad0a54a6059339b2267e96160cd6ce_2021-12-07__162610.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6232e959-57ab-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638915414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638915414, "uuid": "9eb9d4c6-a216-4e6c-af73-7299a6886e04", "comment": "Malware payload (AgentTesla)", "value": "af38e98750809e1f41ff0d564dd05bff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638915414, "uuid": "25a409d4-7b0d-4b26-b89f-32e7b48989d3", "comment": "Malware payload (AgentTesla)", "value": "c56825a634ce92d960345fe0782cd39d7945f674d8c24899700a1eedeb3ebf11", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638915414, "uuid": "0e75e014-d1be-4614-9244-46f624867b52", "comment": "Malware payload (AgentTesla)", "value": "866e11937d00d548cf62f08df2e29d37a8a85ac0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638915414, "uuid": "688bf430-dd43-4f6e-8ead-1816deb7f2e4", "comment": "Malware payload (AgentTesla)", "value": "f2e6a4806547d8519ae9171748ddea5688d85ee1182bca8c67b9bcc5ca2a903c2170d11630b450677f21afa11e812557", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638915414, "uuid": "6082b990-858b-487e-89d6-c417bed0cede", "value": "T1AAB4D0402BEAF699FD37EBB54CB276C587B4F5D5E901E0DEFC94344D89A2A400E109B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638915414, "uuid": "db5cddc2-1a35-4fc1-b531-f4a258061042", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638915414, "uuid": "675676b2-06de-4084-af18-e6263f5af6be", "value": "12288:/MwXzDojZsmPCTRQw2oSQKVVAh3EeST26PO/rC0jz5:/FXz0jVPDv3uhUZKh/rZz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638915414, "uuid": "433e1e53-66fe-4069-b3a4-4a1bc8cea56b", "value": 518144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638915414, "uuid": "80c48df8-a1e6-45d8-8257-102dba596d54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638915414, "uuid": "f59f6880-585b-4a54-8f75-4c241eb886e0", "value": "PROFORMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0054357-573d-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638868273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868273, "uuid": "799bdb0c-f183-4fbb-b51b-45d33698f466", "comment": "Malware payload (AgentTesla)", "value": "af881abee8555ed0921f5f78aa4140a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868273, "uuid": "be036751-6c90-41ff-9318-acc722e923e0", "comment": "Malware payload (AgentTesla)", "value": "c673808d853a04aa19fc880cc5f8ca2227142cadc46b0e26ee250d7b647e1abd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868273, "uuid": "53db70ae-54a0-45f1-8e0d-9b27710046c8", "comment": "Malware payload (AgentTesla)", "value": "847c2ea04fd200a4d59c5ae5a19e598b374b8c5e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868273, "uuid": "2ccd497d-aa68-44ea-8201-dd297fd6e860", "comment": "Malware payload (AgentTesla)", "value": "1d9fb13f2c186c7f0b5d02603061f049b07171b8f82ebb274233e6dfc0ab1d69b613c4de4dc51f0ba5e44a204784a53f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638868273, "uuid": "8ab36a66-1b6a-4dab-b1a6-5baf663396df", "value": "T1498423E01C5225EC4D62576BA5E1C7BD22CFAF9CD0A58F81E6EB4F3945CC60835680AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638868273, "uuid": "e52872d8-0ad0-4dd6-bb3c-b4c596fc3132", "value": "6144:nAoGLB6Ecb2rvSKZ1DbK5d7+J0ThO2cgiXNiAYq/s3JbHeONb/cvRoj/BHQ3Jja:AX1OO4y0ncgaNiAYoibHeCOR0BwZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638868273, "uuid": "2f99d4f3-87ca-40c0-8eff-52a5854213c9", "value": 395960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638868273, "uuid": "c181b030-1e59-4805-8b6b-8a1e0bf6578b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638868273, "uuid": "070196f1-2d1c-4a11-82c9-3bacd731d913", "value": "Invoice#8977.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6323f9fe-576a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1638887498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887498, "uuid": "0ba7e9c4-5914-45c3-9667-83926e3db92e", "comment": "Malware payload (Amadey)", "value": "698b54905fe3924e36cdc079c687b220", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887498, "uuid": "83fcb87b-6886-47be-b948-b69bebb30dc7", "comment": "Malware payload (Amadey)", "value": "c69fa050b5a04328855328e166cf0f816fbbbf0c6d4e1c5939bc985a6b02ade0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887498, "uuid": "da11fd08-a046-4620-8576-095e843b9b7d", "comment": "Malware payload (Amadey)", "value": "ac296605a1a32a70279ec1ac79acd42fb449b958", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887498, "uuid": "c57be8ec-1072-4c08-a062-5c7edb985bcc", "comment": "Malware payload (Amadey)", "value": "0fa15e46bfb8c79e26356f2c6e01a7ffef4694e9c82fb44e04e42e1ec37a8195e0d0e0fdcb33be13c44f1f868a3fb1af", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887498, "uuid": "855ebfb8-4aaf-42d4-b09c-79c0ca98ca94", "value": "T100648D0066E0D435F5B712F84AB9A279A53F7EF16B2490CF52D526EE5634AE0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887498, "uuid": "3129dea9-8817-43bf-b920-4d00e00cbc42", "value": "b5d39f822cf46cb1cac0e9a27db40014", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887498, "uuid": "d22d7f07-f2e5-4e24-b71f-f681d7435e18", "value": "6144:Vhp1LCnxC/gdppUUlUVCkKlaL/rQWvXdGuMAyRge:Vh3gxC/gdnUUlUCkKlazrQWIuMtRg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638887498, "uuid": "c150c781-edaf-4495-bf5a-5c8a714780ab", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638887498, "uuid": "0f0547e1-a98e-4273-85a5-1f1dcd1ef3dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887498, "uuid": "bfa15499-e341-4d3c-b821-c62f4badef20", "value": "698b54905fe3924e36cdc079c687b220.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d6ce6c-574c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638874807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874807, "uuid": "f69989ee-7ebd-412f-a237-3159c5315eb4", "comment": "Malware payload (Mirai)", "value": "ca2c064aa5fdd8af2a7abbdaf69cd6e8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874807, "uuid": "734611e6-b271-4089-a0cf-4567c1c03042", "comment": "Malware payload (Mirai)", "value": "c7ee17190ed5cde6c5ef3f782153f502e85e924aa48803bf9771b08f9798a658", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874807, "uuid": "e305dc72-6a43-48a3-8d67-14201f3ff9ad", "comment": "Malware payload (Mirai)", "value": "8d69155f8ba7d32d3184f7943867467d6f783988", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874807, "uuid": "c457c6fa-ec0e-494a-a601-84040f639aa6", "comment": "Malware payload (Mirai)", "value": "e70df4a081941fd22ef888544da142bd7f10121c099b0922a61c0b85b2256bd650376d97a1198dcf319a16523f41f845", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874807, "uuid": "bd988ac0-4ebe-4819-8d76-1b2a17e07f89", "value": "T1D7531991B8D19A16CAD423BBFA2E418D332563E8D1DF3213AD252F5437CA91F0E77642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874807, "uuid": "80100ab2-ffe6-422b-9522-2779165aab41", "value": "1536:0yW869O3GXz/z8a5O8isr9M53e536c0PKwl5PwC+VUz:0yx6EK3wJsr+5OR6hCwl5td", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638874807, "uuid": "f5d206a2-6dbc-4a56-8205-7f2a2ce54740", "value": 62456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638874807, "uuid": "c256abfb-9fc3-4020-baa9-e5dbf6b64f84", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874807, "uuid": "55825743-e2cc-4513-9d3c-f96be297c01b", "value": "Hilix.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e63598-574a-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638873995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873995, "uuid": "41ae0839-48e5-44eb-b399-9c942c240752", "comment": "Malware payload (AgentTesla)", "value": "9582d28ddf82bd6c49336f620d3fcf87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873995, "uuid": "182a22d4-1bdc-4dba-ba68-d40fb2c13b21", "comment": "Malware payload (AgentTesla)", "value": "c8262f980bc426f0690a7007910673568aa2595af3d8d1d597c528942850f438", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873995, "uuid": "7c00a5d9-e110-4e61-8edd-fdc320513e04", "comment": "Malware payload (AgentTesla)", "value": "7da124d0d474a7346c02e233e64b6d7ba478c290", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873995, "uuid": "98fce4e4-a617-424c-9089-23414de1d9aa", "comment": "Malware payload (AgentTesla)", "value": "0642d78d5f57272f0f40a35dd007328aa4525fbd6b5632cb9175e6050496136631d031a4b9ffba632eb2e46045ce2e06", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873995, "uuid": "c587aced-bc79-4782-92a8-d7d02e3f21be", "value": "T12D3512BC3AC722CEE51152BA37AAC03802B63D35401BD59CF2AA750FA9777057A73607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873995, "uuid": "c5a6469c-47aa-42de-a724-6b4d92b24338", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873995, "uuid": "ebaf5f86-ba5c-4317-be80-f5c8cbb61ddb", "value": "24576:yymdEqh6DoAGVSpARMDL5Qg7wCVop9E7CoiHSh+GVZx:jMwoAySpARwQEUTE7myhPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638873995, "uuid": "c233f838-ab15-42b0-8fa1-b8bd47d5fa1a", "value": 1118208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638873995, "uuid": "0f2afa74-6ef6-4af6-897b-f98e039a3094", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873995, "uuid": "bdaeeab9-5622-47e4-ad15-0f6599ba96da", "value": "ozz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d81d65f5-5798-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1638907451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907451, "uuid": "bbdf9675-6554-45e3-8527-7bb880a2d5ba", "comment": "Malware payload (SnakeKeylogger)", "value": "7c761e677c6c12bde4970fa37115e4a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907451, "uuid": "f3ea466c-236a-4c56-956c-b31aaf9b1a4c", "comment": "Malware payload (SnakeKeylogger)", "value": "c8e971638c57e9cd838e2de9de072dec4a96ae780f722e99c21139732a133a51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907451, "uuid": "13ab8fba-fb61-47f4-8c5e-bb6fd5eb0b0e", "comment": "Malware payload (SnakeKeylogger)", "value": "5bd39866c515d272e2f96fe633294f449e7ba7d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907451, "uuid": "8f000ab3-8ac7-4e17-8fd7-13e346aec5cb", "comment": "Malware payload (SnakeKeylogger)", "value": "02d15c57ca3db29cb53cebeca3beb06d7d0f0e7853507c4727cceab18286e29999d893bfc6125ed47d969cc139c5dd99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907451, "uuid": "e3b036ea-141a-430c-8d2c-b653c5c8ebda", "value": "T1310512372BDDD616C3C97B32E4E600B046B1AA8276D3E74D551EAD0D2B1239265273CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907451, "uuid": "094657b6-a154-4f93-b86a-f7fec0661484", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907451, "uuid": "05fe1acf-a63d-4bfe-acdf-6b79d11e996b", "value": "12288:TMOhiOI9ippgpwOqTanQ6D8+co0b3gGzCFsu7MFhp1RHoS1AmqBFjGCjLTLXaen:gQp7+nt8+coOQGzyb+RHowq8EL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638907451, "uuid": "b11d7259-0bf7-4cf4-97ce-5479dbeea288", "value": 830464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638907451, "uuid": "7926b3c9-5232-4c40-b902-a662aebf9cdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907451, "uuid": "e6391e18-8084-4b9a-b29e-234c8897a68c", "value": "7c761e677c6c12bde4970fa37115e4a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45f0565-575f-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638883017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638883017, "uuid": "2f2c34eb-ed26-42b1-972b-b2ba0ddc3e46", "comment": "Malware payload (AgentTesla)", "value": "f09cab57c5bc03d68f36335128eb8aec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638883017, "uuid": "1ff3500d-501d-43a2-abd7-3ab0aaf54191", "comment": "Malware payload (AgentTesla)", "value": "c92bf7affb6584723ee94e8354881b692ae40964ad61b64d1c0e9a1e6378131c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638883017, "uuid": "040a2558-20a3-4c82-bcc5-c6dd4316ca23", "comment": "Malware payload (AgentTesla)", "value": "2f2a4e132f5a6a63cad9ad01d1e21c435deef43b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638883017, "uuid": "b3bdf01f-66ad-44ad-8048-c03b6497b379", "comment": "Malware payload (AgentTesla)", "value": "556f1de551b2544039ec4caeab1201d44741a0e3757475d7a17710a05a44c3da267376b33853519d831a3948f6ab7d3f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638883017, "uuid": "023cdbc7-ba48-4725-beff-fbdcaba4ff2b", "value": "T1ED35223D366771CFD64185BD37AA9070227AAC76610BD28EDCEA312B1D7B6C17A33142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638883017, "uuid": "07ab85d4-71a2-4773-9c28-29ee69dddd42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638883017, "uuid": "d4a13214-a9d1-4611-9809-051906474ddb", "value": "24576:MPBhtAm0bvVM6IDoULRF4UVPGBP6OhMMDCSzU5QSb:MPBcmZ6IbS6+BP6OaMG9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638883017, "uuid": "574f930a-8b28-4262-8555-6329e9cb66c3", "value": 1085952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638883017, "uuid": "cb61058c-3459-4816-85b1-7719b7c14e99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638883017, "uuid": "da8e2dfb-2dee-4106-bd86-d5c74151d33b", "value": "SHIPPING ADVICE#ASEAN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdfd5312-5771-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1638890764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890764, "uuid": "79456e29-24e3-4d77-887e-72337053c849", "comment": "Malware payload (RemcosRAT)", "value": "e8b98db5bf7766a3c7c693315f552dd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890764, "uuid": "570446a5-0624-49b9-a827-b6ddcd9013d5", "comment": "Malware payload (RemcosRAT)", "value": "c973d3854db8fda1ff848848ab641660e20f3df01bb52426c13c01876115518f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890764, "uuid": "58b80a92-70f6-4453-9a1e-03e7ba91c1dc", "comment": "Malware payload (RemcosRAT)", "value": "637e0572e679d61b66eca0121cae0a546489ec0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890764, "uuid": "e21f6fd1-6cdd-4131-bc46-f6da2d727eb8", "comment": "Malware payload (RemcosRAT)", "value": "2c698af1e596c24f2ce09f41a7a9081d416bf574fe39df65eff63132bcc1b25452c26c598a46cec4be396e0f909dad1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890764, "uuid": "1931f71b-52fa-4e36-9323-43c1f99e574c", "value": "T15BE43A0EA612C245E80CBF74FE7F3FB017909DB7DA55931FA2083EADA47B66509C1252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890764, "uuid": "ca2ed61c-b424-42a5-9420-9da8a7de3e7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890764, "uuid": "459caf2f-df49-41be-8651-f558cfa0b9e6", "value": "12288:chr0P3BxLVHbwTwqsFS8M3nD+DyQ0N9C4pVZ/jzvu12UksWl:chr0PTJbwcSFSDyJs4prfUksWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638890764, "uuid": "bf05f097-33e2-4493-bcc4-cf60b7e95c4b", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638890764, "uuid": "c7e1f64a-b01e-4832-a229-4c75c4022ed5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890764, "uuid": "91d1bbe4-45c1-407d-80f4-199236f5362b", "value": "e8b98db5bf7766a3c7c693315f552dd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa63a27-5750-11ec-96a4-42010a9c0029", "comment": "Malware payload (Matiex)", "timestamp": 1638876236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876236, "uuid": "a805c611-cb1f-422a-aebf-79f759a2b9d1", "comment": "Malware payload (Matiex)", "value": "c2fac2ea47b1e31d976cd6850258c64f", "object_relation": "md5", "Tag": [ { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876236, "uuid": "df6f47dc-1189-49e9-a755-90c8911283b5", "comment": "Malware payload (Matiex)", "value": "c9ced202bb7bf9e49e3cca8da6d6154aee9f10d54fb4e88735a7230f988df885", "object_relation": "sha256", "Tag": [ { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876236, "uuid": "28979647-35fb-4796-a141-ae50563348eb", "comment": "Malware payload (Matiex)", "value": "a3a2865d95140d64c1798dcda1377fc1f6753451", "object_relation": "sha1", "Tag": [ { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876236, "uuid": "ed9b0f0f-07ac-4267-bf3f-81199165f56a", "comment": "Malware payload (Matiex)", "value": "f8c67e0030905d2d7d927ea08d46e799f62d21bbdbbc6b707cafb6b0907f7888fbb133da76f7f3cc3474092794bd0950", "object_relation": "sha3-384", "Tag": [ { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876236, "uuid": "6f8175ea-496e-4d47-ac84-e0bb4d5d39e8", "value": "T1523412ABF29956FCCD029E738A2C77D84C16CC293454E3794BF9F1467EFA99260024E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876236, "uuid": "12ac9b03-262c-4ef3-a5b5-b5ad277543a1", "value": "3072:BC8MRIGMOt6U7Y1Dr9bf6lITSMFNP42yuFZJQurUfQ1s0GBJgv2rnTzDto9Rn14j:I88IGMOtF7OSITSMFZR8QlurDi9BTFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638876236, "uuid": "1e10e4ee-2df9-4282-a586-0b5814edd35e", "value": 234376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638876236, "uuid": "c81fc82b-f142-4737-91f4-992653303cd2", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876236, "uuid": "6637a479-9c31-463f-9148-be50fe984aef", "value": "Order .xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1c9ba7-574b-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1638874039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874039, "uuid": "95da3d7d-2214-45ea-8a39-d291718bc616", "comment": "Malware payload (SnakeKeylogger)", "value": "a3f88b358aeb96f7d3cce152c6ef88f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874039, "uuid": "a70035e8-8463-44e5-bc1b-941d994f5d01", "comment": "Malware payload (SnakeKeylogger)", "value": "cabaec74ffa9d9e52b03f48c8ff2c3e87c98aa39c032c7f82385c3b11f5d0025", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874039, "uuid": "5ec89e7b-51d3-4742-9778-0a0e856585fc", "comment": "Malware payload (SnakeKeylogger)", "value": "71f1ace1dbdfdf252a6353e137e76003ef0c1b73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874039, "uuid": "16873419-b844-492e-97d3-01ae91a8a412", "comment": "Malware payload (SnakeKeylogger)", "value": "7c2c45bf1d4ee88c6753b30503a4c462169ecf663f35d06df4388edcc2aee424fbc9dbb582787fc9192c749e0f1eb882", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874039, "uuid": "536b2fa1-8cc7-4eab-9357-a6890f54021b", "value": "T120D402B011ADCC90F81E8534822E7B3A69BA7D521840D2E92D15FD26CE77351EB63E73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874039, "uuid": "55c2a48f-6dd1-410e-afc0-137413d686f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874039, "uuid": "6bfc67eb-d1d2-4313-8bf3-03f90a5a9828", "value": "12288:gvMi23I0+yiQT2Z+KgbFE1toqDMBMzXLoklQ7PfYokNzjI5s+BTo4/X:kMi2j+yPTUHSEn6Mozf7kNnmBTo4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638874039, "uuid": "9e9263fc-e042-447c-a8bd-e6724e9c05cb", "value": 610816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638874039, "uuid": "df926850-259a-45b5-b189-3ed2e5d417aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874039, "uuid": "9726abe4-31e6-4384-a4d1-8d05c07955e3", "value": "a3f88b358aeb96f7d3cce152c6ef88f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788c1ac3-575c-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638881521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881521, "uuid": "996b3112-d70f-4ace-bdcc-ccbc818f422a", "comment": "Malware payload", "value": "f876b37cafebafaa543a9695001b9bc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881521, "uuid": "aa4859d6-e97f-4d4e-bb04-11782c8358fe", "comment": "Malware payload", "value": "cad706902e2e39dcf0397bac9ab878499d8c8c75d073b5aea76f99b8b474a6a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881521, "uuid": "8d3f9957-fd46-41b8-9585-7ab12ecf5090", "comment": "Malware payload", "value": "84d668c19518bc3e922dfbc789cab952b482e62d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881521, "uuid": "08aa3636-705d-4074-8183-28ad964cfabb", "comment": "Malware payload", "value": "56aed6968b14ea7ceb52d2942e0de41e0ef81cb4c2d92e00a303f17083687d4e84c0d9b9df633b43a4dbb55734a0264d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881521, "uuid": "58d02277-4ecb-488a-829b-93d638853523", "value": "T1DA02E605FAC042B3E2F134754319AE7187BEE427A7B9B2DB971448391F216C29A3990E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881521, "uuid": "498cd976-f9ab-4a8f-84d6-b2c9981ff860", "value": "192:EzXgmZvpYteY+mRJRibt+E/fQBceZNTl+GJy:iRZvp8eY+mzRipRKplC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881521, "uuid": "5b15efd7-b5a1-4280-ae7e-c98dd3366678", "value": 8427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881521, "uuid": "e75dc662-c2be-41e6-8547-6ead46c9d22b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881521, "uuid": "936fb122-3141-4c1e-8305-68261a89f974", "value": "f876b37cafebafaa543a9695001b9bc3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3078ad3-5739-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638866640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866640, "uuid": "9346edf5-2033-4245-9df9-486987129c37", "comment": "Malware payload (AgentTesla)", "value": "b5046a09e4905ed42c4a58468f92b575", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866640, "uuid": "400b2a58-9a66-4d83-988b-08fb2abb9bb7", "comment": "Malware payload (AgentTesla)", "value": "cb1510880e53e660d4dcdb624b3f180c8dd5ac588b3b996b394abfcfd8e5d8bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866640, "uuid": "2caf47e2-ff21-4a76-9cd9-340aa91b72a3", "comment": "Malware payload (AgentTesla)", "value": "9c6bed705b769de28ad348699d213352e3e3f1d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866640, "uuid": "c24c335b-2ac9-4dad-975b-47f1c3953ad5", "comment": "Malware payload (AgentTesla)", "value": "bf72bee62d83e9da3f6c63656e1359db88dcddf809953484c5b84817267b4795dd1faa2dbd9ad6cf1524df0f5a7d331a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866640, "uuid": "d9c03ce2-cad5-4748-96bb-78e32edf95b0", "value": "T194D423974037CF65AE3D3E66BB89D2069D58672A0CD848C1F99F2D30A38DC1D1AD36C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866640, "uuid": "b0579b86-8c03-4637-808c-c677935af829", "value": "12288:/0A7EWyy91kXL23ig9dr4ZI9/EmZ2zy9YebGDse2cnEudINLsMSxN+RW6w:8txgkb23JdrBvZeytIssnDdIBsMB86w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638866640, "uuid": "485a8510-8e72-4cdc-8c20-119e4f45cd9a", "value": 623902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638866640, "uuid": "7fc15d4a-52d4-46fc-a617-ab414fde4e35", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866640, "uuid": "9aa5324e-7f65-4b3d-a647-31b97af7b729", "value": "payment advise.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49e317eb-5763-11ec-96a4-42010a9c0029", "comment": "Malware payload (Nitol)", "timestamp": 1638884449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884449, "uuid": "feffd785-9f8c-4ea9-9a1e-022a833767b5", "comment": "Malware payload (Nitol)", "value": "aa0b8e24edeca2b1e3a0e6c9961af43b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884449, "uuid": "93b3043a-8f25-4989-bd3c-dcf6e35772ca", "comment": "Malware payload (Nitol)", "value": "cb3d42cb0a374cded8d38f8403df22170689a5e196c98186d10495e60a798837", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884449, "uuid": "241cb7c5-c98a-4a3a-91c3-ec8a2b161a1c", "comment": "Malware payload (Nitol)", "value": "c17a74e43ff4bc489d0f396cc56a2d3eaee36ea9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884449, "uuid": "ef08d45c-cf62-4a25-b482-7ea5b6ecbab7", "comment": "Malware payload (Nitol)", "value": "26f33b9a52dfd84210f2638a5e98650489dfa25daa288c82e196d9afbfb759c1a052588aa72dac10d8a8fc15d0428e22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884449, "uuid": "7a001dae-e905-43eb-8782-39808f94fe7b", "value": "T14723F1471F6D43C9D0B522FD1A17B55D2287A87B8E68C7160C0A89F3AC763D9933172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884449, "uuid": "4c0b8855-ecaf-4198-870b-859c03527c47", "value": "5ff234c2f3e4c3ac73f972b751acf90c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884449, "uuid": "cb6c80e0-fe0b-4244-bc21-7da2461e1f64", "value": "768:jVH/ZHpSCNfOGb2atR/gyxHbjJhh0CzPA3NAJjxGkXy/F9vD85+zYITBO42Dmd6p:j/ICVOGbtRIyP70CzONAZxByjvD85qTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638884449, "uuid": "f23b99e3-5710-48b4-9aa1-a5300e3d85bb", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638884449, "uuid": "0fbb9ef6-f94b-4358-8365-15c7b90df996", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884449, "uuid": "d1627320-db8f-4c87-9456-ccb7295e4b10", "value": "aa0b8e24edeca2b1e3a0e6c9961af43b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47053e2d-5775-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638892175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892175, "uuid": "9b8b1aa1-5267-48d1-90c1-8335661b2307", "comment": "Malware payload (RedLineStealer)", "value": "9ffd9e1fdf401de78ec67032e456fbef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892175, "uuid": "3411e944-9084-4bea-9fa7-d8bb37fb2823", "comment": "Malware payload (RedLineStealer)", "value": "cbc599190564686ce0a3b1f77fc2064664fbf2d5df6568975a41a32659216e00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892175, "uuid": "ed4f2720-e1c7-42bd-a1d1-e004fbb66a20", "comment": "Malware payload (RedLineStealer)", "value": "be753b0c5e07ba2447b29662c2ff11d96ab8d02c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892175, "uuid": "0d1e8911-c29b-4df2-b1ac-82859ab8ac97", "comment": "Malware payload (RedLineStealer)", "value": "1e1b407d95be99fccf639ca2373e9889a41e67ae0ea95794920cab4b2d0d5f03cbb9c7a6c1258103ab44cbfcd019131e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892175, "uuid": "c7fad604-363a-4c22-9f27-807ce51ba943", "value": "T12194BF00EAE0D035F2F352F85AB9A368A93E7DE15B7450CB23D426EA56749D1EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892175, "uuid": "60602ac2-af69-4c17-bf39-8ca6fd6d22e8", "value": "b5d39f822cf46cb1cac0e9a27db40014", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892175, "uuid": "36e55677-be25-43fd-b1b5-5e7cc56a8bea", "value": "12288:tT0axme0UMNRdR+YZD58wwAA3KXnZWjezY90MuYM:x0axV0UgdZtvMuZjY9lu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638892175, "uuid": "5e37dd39-bfb8-47b5-89c6-451d23fe00eb", "value": 431616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638892175, "uuid": "20e61b79-dc91-4a13-b3e2-0d9662564c17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892175, "uuid": "f8f65b4a-80dc-4e1d-8935-f061e7d20013", "value": "9ffd9e1fdf401de78ec67032e456fbef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dceca59-5774-11ec-96a4-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1638891811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891811, "uuid": "9d79f665-3177-4a98-bbd5-8176559ce15d", "comment": "Malware payload (AveMariaRAT)", "value": "2eea7298aba518604cb0d15dc7fb3d99", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891811, "uuid": "353515dc-3fb0-4cfd-a366-3713fff29db0", "comment": "Malware payload (AveMariaRAT)", "value": "cbea8cfcac9ec5e93fda9cbbcf7b1c75c2aea672cc580a5235f164ea1aaef315", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891811, "uuid": "8ebda745-6af9-423d-89e3-b89a766e2641", "comment": "Malware payload (AveMariaRAT)", "value": "41d8069634e96caad36da5253bdec2e3c6614f96", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891811, "uuid": "1dc4c89d-d9fb-4911-b3e4-c3ebd15636a8", "comment": "Malware payload (AveMariaRAT)", "value": "6e47a5b9c725214be7970861fc9a4349bbc1ab57844e3a0b99b2665fa26ede6ee3062fdd65ae8b4fba3bdb28511291d0", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891811, "uuid": "1a3ca0c8-5751-48df-a671-1659c3cf6fc2", "value": "T1F43512BC7693ADCEC15532B7775A90F8D2726C325123F28CC869324F3923654B5E36A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891811, "uuid": "de924bed-f6db-4428-ab71-3bd7e768a1a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891811, "uuid": "f3b96e09-1ab0-4f80-acab-3044e15418d6", "value": "24576:FUUUFUUUUUUUUUUUUUkMwPEseMH287lAPXnym9ZZfeE/QT1biczIZ:FUUUFUUUUUUUUUUUUUkJEsBWUmyS0Jil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638891811, "uuid": "e34b8420-f8c2-4473-95b9-e9cd027883ed", "value": 1103360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638891811, "uuid": "a5afe594-b93f-430a-b192-8fc510dab5b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891811, "uuid": "95c58070-4f45-4ec6-a4a0-ab40c1ea0549", "value": "2eea7298aba518604cb0d15dc7fb3d99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9e87ba-57b6-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638920322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638920322, "uuid": "da495b69-03c2-4594-8b16-e60eb2dc3b0c", "comment": "Malware payload", "value": "84f4ca685a783fe9c9383bdc40dac85d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638920322, "uuid": "8cde0a85-520c-44a4-8ba8-f50f0edcc725", "comment": "Malware payload", "value": "cdaed6e6cdcbde86a775f0fa3be338b4dd9e11a6bb418464287ed8a28fb7c429", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638920322, "uuid": "3e44c757-8093-4ea5-912e-31298597ed15", "comment": "Malware payload", "value": "00624a53f1435554ef7419d08be3785cebbc7550", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638920322, "uuid": "a5c1c4d7-4b25-4d42-89ac-cbeef1e108aa", "comment": "Malware payload", "value": "c271966939e4885e4eb6b630d61976d943584981f65cc55b9b5dd5cebf8745bbce10fb680e58929d20c390f2876362b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638920322, "uuid": "c88ba691-6ad5-4ff7-9d7a-52999f5baf77", "value": "T1FF044A3FEEEAD0CCD50910F1D736D2679C36F93DE43A96679B4A07C8B540E1298AE094", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638920322, "uuid": "6a1edf60-b67f-4fa4-914b-577adece1980", "value": "e8ddbd2baaaed2dc68be66f7ade293b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638920322, "uuid": "6a29cb4f-19e2-4eef-9212-63be9aad547a", "value": "1536:I2IxaPXI3C7t5HlmC9FRFwp2yyBzrmoepfr5euqWcUTCBqZVSI1xS6Og+eJ2Iqyu:I2bwxaRF4yprSS16iaJXwrEQMwdvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638920322, "uuid": "1706865f-8e30-4103-83a8-1f23354b3f63", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638920322, "uuid": "b4dfca09-363d-4ba8-a818-2ce38373ed89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638920322, "uuid": "bd0e4e15-1112-44a2-b555-510ca25b6cc7", "value": "data.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89745fbb-56f1-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638835593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835593, "uuid": "a76103b2-8fcd-4f2c-8a51-14f47557504e", "comment": "Malware payload (Heodo)", "value": "a615a8d6cf85b2737a824a6ce8490aa8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835593, "uuid": "2d622666-c143-44bc-b711-411d1ecbeac5", "comment": "Malware payload (Heodo)", "value": "cdd8628cda506a353bc39f1a29a44866d1b8b1c639c2198db75d6a3f26e8842c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835593, "uuid": "78d0713c-b9b4-46d9-a28d-b1ec60205054", "comment": "Malware payload (Heodo)", "value": "a57bdb99a0edc67e89f4cf263bf57e9aad816d93", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835593, "uuid": "427c4074-8e20-487e-bc86-72a1937ea1a0", "comment": "Malware payload (Heodo)", "value": "9b2e4bcc38d419fff5f2f93fa764311d7140311c2719599b4a7842ad6b01dcbfc76105f728e355341f30dd719ee4fbb5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835593, "uuid": "11a10ef9-6f2f-4f1f-80de-8a3509ea82d6", "value": "T181F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835593, "uuid": "92dd14ff-7b2a-477c-a6d1-988cbbc76665", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835593, "uuid": "8a0c0e70-7f81-44a1-9685-9a1c8e12b0ff", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/V:JapiKiBEmj4GbOX399Md9J/0T/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638835593, "uuid": "3b61a830-f504-483f-9ad2-35e9f8df979d", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638835593, "uuid": "0d13e371-7486-447a-9f6f-48e4f96d82e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835593, "uuid": "273987b7-1fbe-467d-a2fb-4f5480d07f9e", "value": "emotet_exe_e5_cdd8628cda506a353bc39f1a29a44866d1b8b1c639c2198db75d6a3f26e8842c_2021-12-07__000629.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc2fab5-575b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638881046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881046, "uuid": "f8de48b0-76d9-4cb1-b390-75ab581fd495", "comment": "Malware payload (Formbook)", "value": "5c3e5bb82655b9e9d4c4de37b8261e9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881046, "uuid": "bf7ee838-0019-44e8-8a59-3763642540e6", "comment": "Malware payload (Formbook)", "value": "ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881046, "uuid": "b5c815da-4fea-441e-9e92-932d15633459", "comment": "Malware payload (Formbook)", "value": "8729efef21702fa0af0ddf315fb6f07e1086fe65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881046, "uuid": "11dc7776-ebac-44be-856e-09667eab1a71", "comment": "Malware payload (Formbook)", "value": "c37a27431c4392da26f743655bc599da0f07a46777dfee63cf8e4b8636ab1976f5b17531b37039b3faf540b9afc0fa04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881046, "uuid": "4f11e666-b235-4884-8605-ca1a83894cb2", "value": "T1382522AC3B9357DEC88667B53726907452A73C3A812BE29EE49B314F4A337057563342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881046, "uuid": "7603309d-9550-4358-9f77-fc914fb8b2c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881046, "uuid": "3c7b9ac7-3465-4217-a189-f0c2c9c0d465", "value": "24576:N5jILBNha8uoy5YOmixdNShq4TVtwBuKz111FF8z2AT:NGLBS2yuaxvS04T3M11/Fu2AT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881046, "uuid": "0ad4d942-5094-4158-abe5-edfa8491643b", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881046, "uuid": "b39021b9-35b4-4507-a3cb-2491ee25924f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881046, "uuid": "6f55f8df-140f-4fb0-b1ff-a073a82060f1", "value": "5c3e5bb82655b9e9d4c4de37b8261e9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec68930-5750-11ec-96a4-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1638876404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876404, "uuid": "77e0558d-e827-4d17-a066-1e2e41f53bdb", "comment": "Malware payload (OskiStealer)", "value": "e6f108d6d7cf1d0e0c4fd34c5bc1f42e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876404, "uuid": "acee8856-e100-4023-81e1-898e0e113d95", "comment": "Malware payload (OskiStealer)", "value": "ce6e03397d462d0a91e4a87e343c1b85d1578e4d1ca492c183f3d1b38e8bf9b2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876404, "uuid": "85cd2e42-936a-4e2f-8233-fd262e5d4e44", "comment": "Malware payload (OskiStealer)", "value": "938c44cedd8b1a15f69448a5c4c7790a3bff8426", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876404, "uuid": "a2136a6b-5957-4c3f-a246-2c842e314f27", "comment": "Malware payload (OskiStealer)", "value": "ecd211c6926be88993cbc770eda6656083e4039298b2273816a386ca69daa6ee9df7b084f30a007691bbf28e5e38b5a5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876404, "uuid": "e128e940-9163-4987-a1c2-bf9a75350a4d", "value": "T1FB72FDACD05746A48F856BB82B1F6F85118C7A2EF7889632727C973A27D1C7A4513C3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876404, "uuid": "5a2d7ee5-21b0-47a9-af61-64593c6a4c9e", "value": "384:prbx7XHbzg5ds2zPaXt4JDiF2KYAQSUT1Py+0qBJ/ZPpMgveWHWNC:FdXEAQoRIpLogveC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638876404, "uuid": "05a524c5-dcc9-45e1-8e48-c5de4ee6c18f", "value": 16048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638876404, "uuid": "30422c03-3410-4c8d-be0c-f510baf78689", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876404, "uuid": "8151ff8d-f96e-441b-b385-95f2d4c0f75e", "value": "statement.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "886efecb-5721-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638856207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856207, "uuid": "8b1d7a35-9910-452e-9066-05868e2538ce", "comment": "Malware payload (Mirai)", "value": "48aa8ceceeab8307ed0f83c0cd16a284", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856207, "uuid": "7aa92fd6-00d3-47a1-b15c-0607d2959df2", "comment": "Malware payload (Mirai)", "value": "d1060527bcb68dfd70c36b8eff8a75e9465cada8c5f4aeaafc6972cfbf6e7abe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856207, "uuid": "70271df5-d696-4d11-8612-6bd252bc3cde", "comment": "Malware payload (Mirai)", "value": "85e7eb011d7adb37cb070c226058587379d6a562", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856207, "uuid": "d1bf2ac8-325c-4ed0-bb17-b58b9557dff7", "comment": "Malware payload (Mirai)", "value": "db64c380c9c71d14567b99b5e68500f37050bf7802acefb09582bcc0e9f49999b750b51eae9adb9349a9386c2fa3d8ce", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856207, "uuid": "458eda43-6f1a-4993-9791-7a1934959f1d", "value": "T111D2E0A1E146DD37CAB08C74E9676F1033F797ACA0AA38B1D2C8531436C281A5EFD583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856207, "uuid": "9bc448c3-d6df-41a0-8a9b-eaa0552dcb17", "value": "768:Lx2gBkNbpuDmXXx9ALQGLC+IenS5EYTZBBs3UozX:tJ2puDmR9SLC+IeSfTTszX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638856207, "uuid": "b5c5e12f-c1b3-4db6-8480-8660c7226af7", "value": 29996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638856207, "uuid": "c914f0ab-6905-42ac-a47f-0914f194167e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856207, "uuid": "1b2a6a87-f5eb-42d8-a1ab-42be135a9405", "value": "Tsunami.arm-20211207-0550", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78af3a44-57a3-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638912015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912015, "uuid": "ce2d2f98-8a3f-402d-aad1-1dfc1354d6a2", "comment": "Malware payload", "value": "1bc23572c74614b5d000b813725451ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912015, "uuid": "fd968688-0594-4d5c-b1eb-28d28d2c76e5", "comment": "Malware payload", "value": "d26c025f299d9557fbf02d366c39bfbbb5c985a7b5575c1adff4813b2970ccc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912015, "uuid": "d2485dce-359b-4dac-bf03-40845036ebdc", "comment": "Malware payload", "value": "fa0d01b50fbb70c22d6ce4553e0a2b59d5a3a65e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912015, "uuid": "b223f921-3504-4a8e-9bc0-bb85b08e389f", "comment": "Malware payload", "value": "a9425ed1050c02ec6706f9e4c08d9aae7e827c50f6f33e205c82ee2d3eccba9d2cb3f8d47bac8b5a38bd27bdabf77826", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912015, "uuid": "53ad4411-cee3-4b0b-87b7-34b052a7eea6", "value": "T1BF3512AD3B9B57CDE5A142B833689038637AAC36190BC14DE916335F6C33715BA73B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912015, "uuid": "73d7f5c9-541d-4347-b0c7-59638bc2e107", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912015, "uuid": "2fc88e5c-915f-4ba7-a42d-4382d6a2d966", "value": "24576:JJvuQ1GWxNHOaEk5m3FrMo5qrmPh7Tnq/HcNVXXOOAg:JJqWxQ9kU1rjArmZ7jQHcLHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638912015, "uuid": "43e3099b-953b-460e-83ed-62708559f9f5", "value": 1118208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638912015, "uuid": "6591ec58-4299-40b4-a47b-a7596839bfb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912015, "uuid": "fa0b448e-cbd6-44e0-87f3-5df74772ded3", "value": "12072021-0006354.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ff5454-575c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1638881679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881679, "uuid": "45e37824-fb52-4894-876b-e384123c57c8", "comment": "Malware payload (Smoke Loader)", "value": "e1b0f7affd120181f4c4507ca89c0e8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881679, "uuid": "e3180441-eb70-4911-852e-b106f7601d44", "comment": "Malware payload (Smoke Loader)", "value": "d2cb4acf215d5b84d914d72483a930e12c3df2197f2ba9558a186d32491ab887", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881679, "uuid": "527a86c1-d527-40ab-8004-e2750c45d8fd", "comment": "Malware payload (Smoke Loader)", "value": "8a0cb3c5af621a484f580fab0e0b6f496289220c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881679, "uuid": "da57a15c-387c-4636-825e-2f71f38cded9", "comment": "Malware payload (Smoke Loader)", "value": "cd66e9e199495a26db42abf69b0fbcd1c881440a6b3c9d723525c060ad4c7cbd02766a019845ba68f4b9e1c1c8658e37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881679, "uuid": "f02abd38-7161-402a-9b2d-8f44a2ba1a4c", "value": "T17C648E10A7E0C435F5F712F84AB993A9A93F7AA16B3490CF52D516EE4634AE0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881679, "uuid": "bde4a201-f153-4777-a6fd-c2726e5e8659", "value": "9a4fc332982336bed32e6b1dc80be347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881679, "uuid": "4677e3e9-2a85-4c43-9d39-3d65920c7a71", "value": "3072:+q0myqQJYi8CjFLnMrdCBiZ3Sqb8tbyNWUc4WCaGV6I/1mjLfjyZw5tDYqxxWAsC:KYibwlHNWJ4WUl/1mvjq0thvls2e2Xi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881679, "uuid": "c2e92ad2-a2a0-485e-a9bd-03109f45ef07", "value": 326144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881679, "uuid": "2ba98fe1-a501-431d-9fb6-88ff3f0c2ea4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881679, "uuid": "33de3db4-3655-4527-a436-61ffe792d121", "value": "e1b0f7affd120181f4c4507ca89c0e8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d90c86-578a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1638901414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901414, "uuid": "2d47e6cf-29d7-4975-9282-713789555b95", "comment": "Malware payload (Quakbot)", "value": "d1c44137a6f87a33c5ceb168ae1e12c9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901414, "uuid": "5d9beedb-63c8-4f6d-9336-4c36eb185a02", "comment": "Malware payload (Quakbot)", "value": "d3e8e0e8d4b70ddd8b52a0fdab97c4518031a91ea3cbdffa8c9d82139a9aea8b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901414, "uuid": "7c86bbd6-d0f4-4095-90de-43f851d875d7", "comment": "Malware payload (Quakbot)", "value": "a6a78c8c86853767ab038557fa4fc172f2b10d1d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901414, "uuid": "cd465d24-57f3-4126-bc1d-eca6d0b2b320", "comment": "Malware payload (Quakbot)", "value": "9208e1cdeb4c76a5e53b04232f04313f87a91b32aff54959f33cd6fea08ffe985b775677cf6fe0e9ad4f9a9bd7234051", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901414, "uuid": "65fac6e3-6f8d-465c-a3af-b370b08e8422", "value": "T13BC49E76F6D08837D13325389C5BA368A835BE503D2858456BF81D8C6FB93813E7729B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901414, "uuid": "d841859b-2158-4bba-aa3e-f4b546d21fa9", "value": "c87b0244d3ec3baa302e51fc063cf2a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901414, "uuid": "b7345ebd-1ceb-42c1-acde-e694f340f6ba", "value": "12288:uWXcaMsRJed93y4JPIkFdHl1L8G394abJN2Q8DgrCrhxEP:ukrMwi37Tp1Im5KZgryhxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638901414, "uuid": "7d12b925-ec1b-4204-97f6-3f95d742053f", "value": 591623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638901414, "uuid": "273ef24a-f33d-4e3e-8257-6a7418d20c3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901414, "uuid": "7b51c2dc-9c5e-4a2e-b73b-434ade4cc249", "value": "d3e8e0e8d4b70ddd8b52a0fdab97c4518031a91ea3cbdffa8c9d82139a9aea8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa22b5ea-5739-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638866572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866572, "uuid": "f5253b4f-1e46-497a-a031-62564dcf4122", "comment": "Malware payload (Formbook)", "value": "ff8034afbb78e2a95cb15528595b5909", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866572, "uuid": "ae7b0089-65ff-4cff-8976-1cb12def7515", "comment": "Malware payload (Formbook)", "value": "d417d8309fe2c4ed4531f76a9b10f95f80868b7a39d41fc4408ecdcbc6ef91f4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866572, "uuid": "19456e3d-26ea-4ac7-85a3-103dd2263844", "comment": "Malware payload (Formbook)", "value": "ce87af9ce772034dbc1b4d0451b724712dd678bc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866572, "uuid": "aa1ed289-cd02-436f-8b50-fee7783334a8", "comment": "Malware payload (Formbook)", "value": "be5b3516fad1bdf971657a275ed43224b322542c8e2869834450e28d28dc4e0f003eda1da39ea896708b3ad0044d4de3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866572, "uuid": "55a6c775-9366-450f-86e4-54cc817eef41", "value": "T18625336693AEA9AC592ED76FC881AD683FED462495AD4C3D13ECC24E0F4F47DD19C001", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866572, "uuid": "0dca319e-995d-466c-ba31-791cb64d6f38", "value": "24576:pCsAqENNaTmblnkvFQPHX/Hbm/lwvv9Uu/U3IYhXRJoO:pl6aybd4SPHP7mCNUuSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638866572, "uuid": "58bb6fd7-d76e-40a4-b1b3-b1762b6581d1", "value": 1018493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638866572, "uuid": "3c6994de-4758-4dbe-8ffd-93aafa44409b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866572, "uuid": "192b5040-6759-42b6-9998-526aaff30514", "value": "THQT-ANOVA TRADE-QUEENA.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e4916d-5741-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638869759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869759, "uuid": "56d68da9-89ca-4812-ad2c-e4e78cd5be2c", "comment": "Malware payload (AgentTesla)", "value": "33a9b7aa7239bec95e79eb17fd087fb4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869759, "uuid": "cd4e1111-f62a-45d0-9987-3ec4d787a97e", "comment": "Malware payload (AgentTesla)", "value": "d45517be93e21819bb8d7e0c3008de817e22b7fe1ca23dc0992726cbd00974ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869759, "uuid": "3992cb0f-bcc3-4d98-9f9f-d54647df237e", "comment": "Malware payload (AgentTesla)", "value": "4eb42b1d0150dd97f88efb7a241ab084dd36304d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869759, "uuid": "0b2d9241-b15c-4ba6-9413-b8d61d4853b6", "comment": "Malware payload (AgentTesla)", "value": "22945e03d0c8fae14e89849287ad613fc20533434b772e941a72ae18b06bb7a3ba7c396ddd8389f35bcba4eac1009a27", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869759, "uuid": "076dc160-fc01-4a81-ab14-bfc4078e22ea", "value": "T152145B656690D6E9E062B7B0DD21F6BC402BAC37386108D7BECA76581B31B93C1E3317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869759, "uuid": "dcbed020-ed84-4e5c-9c22-104bd4e949e4", "value": "1536:1DqdK4J28KwgajWeC5FdV1OTlOsLQFEIkc04ts/4:kUo2PPeWeq/mXQUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638869759, "uuid": "b3a95ff9-8719-4ffb-a4bf-5758861ac5d8", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638869759, "uuid": "10c839e0-9e44-4c33-866d-339d3a97f318", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869759, "uuid": "44182797-99a1-422c-9f27-71b8d09c43d8", "value": "SWIFT 09372-973012qdf.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "129149d9-572f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638862022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638862022, "uuid": "45e99a57-d252-415f-adc4-c806d46c7877", "comment": "Malware payload (Heodo)", "value": "e1946f8b65d7e97078b49b66aa614f77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638862022, "uuid": "d185ce0d-865f-44c2-8399-78b72d97857d", "comment": "Malware payload (Heodo)", "value": "d5702823542b617905741e17ae6cd78aebb808816d9b74ae627d5b068b64ece6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638862022, "uuid": "5fb27b86-7f43-4c46-827d-5a85169f1417", "comment": "Malware payload (Heodo)", "value": "f87986b9c6a513995273b3019a9ecf808eaf9e31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638862022, "uuid": "c55ce7de-4edd-41fd-b671-644d0b8c4afb", "comment": "Malware payload (Heodo)", "value": "1854fc9ee0aff58570de233d66a23681bde9ab3f263bc1d461180fcc1821601c0276d867fe9c79652e56706ff51b9632", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638862022, "uuid": "aaa1fa01-c8ff-4711-be71-eb4cb01a6807", "value": "T17BF48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638862022, "uuid": "b5edf291-d181-4d81-bca7-33c0f0197f7c", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638862022, "uuid": "1e654e78-9ad3-44e2-861a-dc8aacae8793", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/b:JapiKiBEmj4GbOX399Md9J/0TJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638862022, "uuid": "8dac3de6-fd85-4fb9-ae5a-86947713022d", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638862022, "uuid": "8ac352f6-b5b3-4f2e-8755-93a6d0c7c9aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638862022, "uuid": "5ad534c4-3ee7-4e9e-aedf-5fb835bfa94f", "value": "e1946f8b65d7e97078b49b66aa614f77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b3d2b2-5756-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638879025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879025, "uuid": "8f4146b0-0dac-4ff5-ac63-7ea9dea9e706", "comment": "Malware payload (Mirai)", "value": "17060d2966b7c47b32f3e71368175697", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879025, "uuid": "507e5e37-6a04-4ef9-a5dc-38297db94a62", "comment": "Malware payload (Mirai)", "value": "d5c5659f032a36e1560dc79c4cca18fc88c7e0af03f01ec678cf4eef1deedb25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879025, "uuid": "71b57e96-10ff-4f38-a0d1-617ba423d20c", "comment": "Malware payload (Mirai)", "value": "722dfa0a3d63c97fe2da05aa3713029d0012a4c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879025, "uuid": "85701f9a-e47b-4864-b608-cd91e790039e", "comment": "Malware payload (Mirai)", "value": "9db4dd515d060c786c98dd53b4ff9767ecf67009dc82f803ac47656f55a2ffb7eba1e21be8411598879743a009f0fcc2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879025, "uuid": "07baed79-85ca-4f9e-b661-80353db11d2f", "value": "T132530A91B8D19A16CAD423BBFA2E418D332563E8D1DF3213AD251F5437CA91F0E77642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879025, "uuid": "128e1873-2800-4201-86f4-557ce808c7bb", "value": "1536:EyW869O3GXz/z8a5OI2sC9M53e53Kc0PKwl5oIXm+7xc:Eyx6EK3wRsC+5ORKhCwl5G/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638879025, "uuid": "4032a661-487a-477d-9c69-a0fbafb5e714", "value": 62456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638879025, "uuid": "3af08265-f09a-4afd-90d4-f920b5d7681a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879025, "uuid": "651fbaa2-02e9-411f-885d-5eb5178c6fe1", "value": "17060d2966b7c47b32f3e71368175697", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8cceba4-5755-11ec-96a4-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1638878729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878729, "uuid": "affc1d3a-c92c-42b3-9762-4e9f5b898621", "comment": "Malware payload (GuLoader)", "value": "9b999133e48e325552968d6fc99b6a5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878729, "uuid": "12c1c1a6-6ca5-4883-af0e-2a7106d67bb1", "comment": "Malware payload (GuLoader)", "value": "d5fcacaffcddb48baab53225cc86e57228daa52621d72a1694f29d657d26577d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878729, "uuid": "ad4ac55a-0349-43f5-96e4-c97eb70d4e1b", "comment": "Malware payload (GuLoader)", "value": "71f68c21ae002e7d5966bc5ebff0457f236efae0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638878729, "uuid": "d81757a9-940f-423b-a10d-df631f7e91bc", "comment": "Malware payload (GuLoader)", "value": "6210a7166b1a66886e337ed4d0b44ccd2dd2e2da7b55bb56d0b3cad6bab34f9bb39276a84bc48605ee5ce81403bceff0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638878729, "uuid": "722bead1-9013-4ce2-a88c-933453c51e42", "value": "T188F328BBB250FF22F215C0F1B70556E840866430E6166463F19F9EB63AB17C5BE4872B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638878729, "uuid": "03106132-d5e7-4ec0-adff-38ca1d49b733", "value": "041bed4e18fb2bf24204621a1040d963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638878729, "uuid": "1a611fea-1fda-4c36-8c5c-1de3fab46531", "value": "3072:sCPmj0tGcS8emNv4M6oT8nupos+8UeGPomE4:sC3tw8eQv4XHPs7JGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638878729, "uuid": "3546062e-6ab9-4841-8e2e-15c75f10ae7c", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638878729, "uuid": "12ced9f3-7333-4bfe-a6fd-cfc079124130", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638878729, "uuid": "0c7ba4d8-f3b8-4e5a-9ec1-41d5d4e7494f", "value": "zam\u00f3wienia n.374_12072021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cbfe65f-574b-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638874280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874280, "uuid": "bffc3b61-3d75-4df1-9635-3421d0132e4e", "comment": "Malware payload (RedLineStealer)", "value": "7f98e524346266f8018ba22eaa6113d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874280, "uuid": "1dc3fe44-da9b-4bdb-814a-d49804941da6", "comment": "Malware payload (RedLineStealer)", "value": "d6b47354dff2693d279b357d0901496908922679207ebef447e78160cd45bdf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874280, "uuid": "616c54a5-2e37-4a2c-ab23-05202245ebae", "comment": "Malware payload (RedLineStealer)", "value": "e778147c2e2c434ba997e96cd4d76dd4cb84ca42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638874280, "uuid": "37b15fa3-a246-4aa2-9eec-e2c3c728c7ff", "comment": "Malware payload (RedLineStealer)", "value": "d9bdec2ae52129276beeefdc425ed29080b6c14cfa9c9d44e15ff2b5f0f860f014ae9a2c406a240bafa3d6d23ab0f10d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874280, "uuid": "52402716-b783-4f0c-b175-2d1458add1bc", "value": "T1AE648D10A7A0D435F5B712F85ABA9379A93F7EB1AB3450CF52D416EA16346E0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874280, "uuid": "e7f231bc-565f-40ea-8ad0-3b5e191da5a2", "value": "bd61429d86f194f3b84d97af55b8c371", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874280, "uuid": "f1adacff-08c7-4b44-8251-2b82b8795a7d", "value": "6144:r/DKRm+26e444ArPCUy1u29oKVSzxr6Cotck4B:r/+Z2U45rPC31u29oOSzxno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638874280, "uuid": "ef438d58-d9e3-4f5d-a07f-1dc21e22f08b", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638874280, "uuid": "5d43b55c-6997-4593-b71b-2c764ef32dad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638874280, "uuid": "46f82702-1d02-4bf1-aee6-1bb16eeca938", "value": "7f98e524346266f8018ba22eaa6113d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7205f703-5759-11ec-96a4-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1638880221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880221, "uuid": "37d86e2e-51bd-445a-a001-13bae92d426c", "comment": "Malware payload (Socelars)", "value": "3342571c8c3245bad06729e4cc421f48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880221, "uuid": "23116bb4-9430-40f5-8fc1-b3b9e5ca176f", "comment": "Malware payload (Socelars)", "value": "d6c0e54bd3705af4d198452a256f19385cf453e50a13b094fe6329f40061a212", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880221, "uuid": "76271caa-23ee-44aa-ad12-9ac23f067a8c", "comment": "Malware payload (Socelars)", "value": "d6e5e5a38f5bdd5273eca4854bec91ea7793b64d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880221, "uuid": "a152bb07-1557-461f-88b0-ddf2e14a96a3", "comment": "Malware payload (Socelars)", "value": "12e2a6b87c74890d64b67e7749bcc6e554d5616685cb58fabe146cbc466558f5726ed1add56fb67a2d7fad1a57f17ac9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880221, "uuid": "d6b4bef7-6fc6-4c9c-842c-cd5d57ace106", "value": "T191659E11F642A036ECE300B286FF4AFE8D6CA621031854D7E3C45DA95E619F37A37A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880221, "uuid": "c77de6a6-2ebb-43e0-83ca-ba088ca7080d", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880221, "uuid": "89fd8998-6909-4f25-a2ab-493f9c582f7b", "value": "24576:ECjpXA4U35ozW03XRp/hESVE5uU2xbVN6pZVnoYL9ZgxWn:dpTJxPNl0PVnoYL9ZWWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638880221, "uuid": "758ebee6-b4a0-455b-93ed-cea5716daf0d", "value": 1490432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638880221, "uuid": "71b7713d-bd68-406e-9639-9013588fdaca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880221, "uuid": "d0df1893-739c-4599-8f30-a7f5ac3e2525", "value": "3342571c8c3245bad06729e4cc421f48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677baf4f-572e-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638861735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638861735, "uuid": "796f3e4d-eb5c-4d3f-994a-c3d3e8008d27", "comment": "Malware payload (AgentTesla)", "value": "49dfa13062040d0d69bc59525ead59f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638861735, "uuid": "a0f8fca8-438a-4457-b08f-b679ba62d4a7", "comment": "Malware payload (AgentTesla)", "value": "d6d391195dc36ea512518b346cc38054453a90bb1c5d58b00b82e93af181ffbf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638861735, "uuid": "36aae8ee-0cfe-4a8f-a071-5310bd29ba93", "comment": "Malware payload (AgentTesla)", "value": "937de6f95f14c310aad38028619e22204b9f5812", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638861735, "uuid": "49d2faf4-4ec4-4074-9d1c-07522fc0266a", "comment": "Malware payload (AgentTesla)", "value": "e457e7b364427c813b7c56ca970d09c2850bf7ae02279d8b3ca5f9aaedae6c407c775fc563b3b2e53556a587dc58c947", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638861735, "uuid": "46ddd763-e50e-4f05-b276-7edb9e58dab9", "value": "T19EA433BB35B44463A9B2AEF34F079D9637B3C493947D1DD88A1B76435BE2412E0C93A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638861735, "uuid": "dd0c5910-c292-4012-abba-8acbc8eff707", "value": "12288:w2U7Fu12xGIhW8LnXMvLPJRpMe5nk3EP4/oF/I8:w2U7K2xC8bILlex/oZI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638861735, "uuid": "5326ed59-53e6-4c77-be90-3f7c9841e90e", "value": 470871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638861735, "uuid": "abbb894b-abbe-4dcc-b136-22de3a942803", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638861735, "uuid": "4b05ad23-9b12-4157-9a91-b9d65f88f331", "value": "statement of account.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec11dabf-5789-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638901042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901042, "uuid": "591b0daf-ece1-4ec1-8493-6e56ae1f4190", "comment": "Malware payload (Heodo)", "value": "eaea5d54dfc47968657694492f88f17b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901042, "uuid": "34af240d-3ff0-4eae-a61a-28c2a4d6775c", "comment": "Malware payload (Heodo)", "value": "d9573982d0daa2edae093ab8aa510e2666d95cac5e9e4909227d2b993416b891", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901042, "uuid": "a047120b-1922-41fc-a4b5-6746c4562e82", "comment": "Malware payload (Heodo)", "value": "e8f655bfc2e35bc409d63480f4ab85127b353435", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901042, "uuid": "ef8c485b-c6b6-4bcb-b247-e3a995b9f928", "comment": "Malware payload (Heodo)", "value": "6df73607155e20c63ca02095947746fa96939f9120cd601f352323da6b6e107661d9bee3e8852681253a0af310550750", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901042, "uuid": "94e9a031-c8a8-4b9c-9b34-c833ace9f824", "value": "T1D0F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901042, "uuid": "194c1c9c-11d6-4fdb-bba4-f2fc23c66b5a", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901042, "uuid": "f13a535a-a7e0-4e8a-a4fc-61f00c2c2afe", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/L:JapiKiBEmj4GbOX399Md9J/0TR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638901042, "uuid": "04566f6b-510b-41d6-a1d3-c31d874c24f7", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638901042, "uuid": "918050c6-eed4-4ea9-84db-b98347b2cd78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901042, "uuid": "209dc001-770b-41ea-99cc-2b47cb8dba41", "value": "d9573982d0daa2edae093ab8aa510e2666d95cac5e9e4909227d2b993416b891", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f9903b-5727-11ec-96a4-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1638858913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638858913, "uuid": "ffb21427-6513-4aef-84c4-fe9aea0ba33f", "comment": "Malware payload (GuLoader)", "value": "37f93d78e75007d5d613396e98637199", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638858913, "uuid": "10038e07-c290-4588-b2b3-299265ab8d9e", "comment": "Malware payload (GuLoader)", "value": "d9b6c1a60bf4d8808ad5da9ec84fef39dd9c2fd82c5dbffe89a66e95f19c588f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638858913, "uuid": "71d648cc-8661-457b-8ae9-74c435bd344a", "comment": "Malware payload (GuLoader)", "value": "30064e8bad2f74d3e60fcd5f150cdc7a20f44985", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638858913, "uuid": "4f590a94-b191-4bb0-98aa-eeb5711179a0", "comment": "Malware payload (GuLoader)", "value": "992c081b8ea06c07ff5d4ad9337400fe560f8c408be6a83b8d85811bf382732bc273bc3ecdf751e19e0a1becfffbc506", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638858913, "uuid": "c1c16150-0d73-4461-b788-9c1a8f035c32", "value": "T165E35A21A290D5D9E105B7B1DD2BF1BC809A2C33791228CB8ECE7B695A31B07D2D3757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638858913, "uuid": "af528447-86d7-4034-be51-010585e17083", "value": "460340e2ce791b610d6d419830ceb88b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638858913, "uuid": "7840e9a5-93b5-4d12-966c-29cffa374e50", "value": "1536:uuNlliWHHhaURareQdwCo7S98pH43aK9bjdVE47unX3:uuvsIhbaEKJ7b52nH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638858913, "uuid": "2ec3ef07-83d9-43d8-b703-be716dbe4bf6", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638858913, "uuid": "ac33a6b1-6274-4474-b7a9-7b09272e7850", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638858913, "uuid": "69549313-9170-4930-8d5f-0875a4debf73", "value": "N_PEDIDO_356479.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdda5045-5774-11ec-96a4-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1638892052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892052, "uuid": "5497a10e-4b3e-44fb-9a17-12de9c5d5ce7", "comment": "Malware payload (TrickBot)", "value": "15776f46dd81ecf7b4f016d0d6a46ef5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob141", "colour": "#015534", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892052, "uuid": "36b86a24-88c6-4a07-b2bf-1b202a20e8f6", "comment": "Malware payload (TrickBot)", "value": "d9fa1526724efed5f7ec523301bf4bf80ac0918790d7beef8485ed72218afcc1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob141", "colour": "#015534", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892052, "uuid": "677daefc-7d2e-47a6-9215-8b83bd789ace", "comment": "Malware payload (TrickBot)", "value": "cbb89e847ada9cd5e67e1f1532abcee1d3132a54", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob141", "colour": "#015534", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638892052, "uuid": "77cccbac-d713-4f18-9143-611fb22486e2", "comment": "Malware payload (TrickBot)", "value": "fb0ab96f5a949a3dc6521f4acb514e364594973701ae2775ef5fc9b131258b787a7d8e5e9e6eb05b49120f72933013a2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob141", "colour": "#015534", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892052, "uuid": "beea7936-9577-4eb9-8da9-4fefcbac4b71", "value": "T1518534041452E27CCA09FCBDC536B49250EF0AA48DA2EC0DED797F901EA16F9D56E6C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892052, "uuid": "eeb56b0f-3147-4743-ac4f-0ac2b6557fb8", "value": "028cb2120eb61bdd8d53c72736111b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892052, "uuid": "ad2587ba-20bb-48fd-97a1-aa3aff399426", "value": "1536:JPwo+LV1pDpmE/X9XMp2nJ+bNCcMk0RzESN9dFMPiT1ak:9sTDpmK9RJ+8RzBfFMPiT1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638892052, "uuid": "2ff90d03-7622-4b8d-bf69-aebe68972b59", "value": 1813504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638892052, "uuid": "c36ab02b-ba61-4332-af4a-4c9674571226", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638892052, "uuid": "96211338-0fb6-4f14-ad98-5cda447f9c1d", "value": "15776f46dd81ecf7b4f016d0d6a46ef5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c52f5b4-5722-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638856455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856455, "uuid": "a50f919e-6399-4472-be80-1f22c7272da5", "comment": "Malware payload (AgentTesla)", "value": "1c673246a7f42a2195527c8e8370057f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856455, "uuid": "2cca186d-6c49-42a5-84e5-62cd822e12af", "comment": "Malware payload (AgentTesla)", "value": "da47ef3d6bf3b98fb414a7b8ed59a7bb2e883ff11ed0a17a31e73ec0ff730c17", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856455, "uuid": "194a29db-7f2d-4628-a0fc-0a40476b704c", "comment": "Malware payload (AgentTesla)", "value": "18f40f477e065a4a144ad7311db9d91428ea4863", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856455, "uuid": "3a0663a3-1938-41ac-aa55-2fee94541309", "comment": "Malware payload (AgentTesla)", "value": "155340bc38a4c37c753e2d318a1fe25fabba351016615d1dda2659a5cbd19cfdb658da6309bc22b9cc715a0c951e3b25", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856455, "uuid": "005f873d-c970-47a9-bb95-61817dfb55e3", "value": "T195243B166715D420CB5F527EC01A821831F1D703A72AE2DF5AA6D8EA2F836CCF90BDD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856455, "uuid": "9e3453a4-afe1-4196-bb4a-af6e590fb137", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856455, "uuid": "f4eec0df-e1a6-457c-aaf8-0cc84dbeff65", "value": "3072:gyhdUIMZJ33824zObUvvCv3vFt0vBJm4VQujAxjOc1fuwjdsj84sQDAW2+zMUGAM:a8aUofFCd+9OczjdsgbqrwUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638856455, "uuid": "38553d26-4e77-4323-86e9-ca092d5817be", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638856455, "uuid": "224da5af-a28f-4c54-be95-8e3ab211d32c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856455, "uuid": "59a28aca-2260-48e0-9728-c84f48ea43ad", "value": "1c673246a7f42a2195527c8e8370057f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3396291-575c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1638881646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881646, "uuid": "a0ded225-a0e4-42f7-9a41-d84d8090dafc", "comment": "Malware payload (Smoke Loader)", "value": "59f19c0c51dd9af08b2f6eacd2f947a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881646, "uuid": "a4c8bb24-21de-4963-87c8-5ab2ddd373ba", "comment": "Malware payload (Smoke Loader)", "value": "da702dc8c9bb7c1448fc8b284a961390466a2a9be3383dc0cd30404ed0dcfef5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881646, "uuid": "dcc3af66-5580-4bb5-8655-a317652d4708", "comment": "Malware payload (Smoke Loader)", "value": "4f93d27337ef53449b797dff32fc27a8d81b75d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881646, "uuid": "994db01c-042b-4734-9132-c962d118bcf6", "comment": "Malware payload (Smoke Loader)", "value": "5d67786b6f871d1be0b5dc661a02058054f84ea7eda0572a2d13a31997abe8437f3bc98ecd3e824afa38659ed242702c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881646, "uuid": "e4c4e675-2a75-4740-ad70-861240d8b6ca", "value": "T161648D10ABA0C435F1F712F85AB993B9A93EBEA16B3490CF52D516ED46346E0EC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881646, "uuid": "7fd9d57e-ad22-42c4-9e41-54908b4f8831", "value": "9a4fc332982336bed32e6b1dc80be347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881646, "uuid": "4944d584-d352-4bf7-bbe5-fb3167fa2e48", "value": "6144:1ABT6BAnGq0uUNRO3EDN1mE9SPx+Xh+1lkyVQegRfx0:oT6OGVuUNRO3EDN8E9Dh+1laegRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881646, "uuid": "4f17dc8b-8a84-4d07-b477-023a5d5e79de", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881646, "uuid": "abeb054a-00fe-4acc-a6db-ae3e1db34198", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881646, "uuid": "0ed2a283-b85f-4ec8-87b2-0c85eef53c29", "value": "59f19c0c51dd9af08b2f6eacd2f947a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a05796c6-5769-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638887171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887171, "uuid": "1f708990-a1fe-42c4-b9cf-79aeacb4f747", "comment": "Malware payload (Mirai)", "value": "ce2ad65cb52d13de3ba4d016915ab162", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887171, "uuid": "ff21e3bd-d66d-44cb-8e63-d37366c1c0bf", "comment": "Malware payload (Mirai)", "value": "db0480188eb3a17ded786fc9844aeefbd02322d0f3145988c0995a1a9bea09f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887171, "uuid": "468dcea4-8ed6-4c56-b73e-20fea1a3bed5", "comment": "Malware payload (Mirai)", "value": "3dcc26534ac4e13ebfc50a0c19d027fdce4dea0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887171, "uuid": "f9d0eeb4-3ef1-4e01-a3de-5c3820b650c8", "comment": "Malware payload (Mirai)", "value": "e74e53410718a108b83d3a29f54d668c927f2a0f358f9c1f4111be3a61dca46145824b00ebfc54f0405ca9024d14fec0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887171, "uuid": "6d3169ff-3ec3-4d8c-9a35-a69f7ada36c4", "value": "T1DBC32B2B3B270F23C0D9507102E32332A9B5D79934F953D7AED16D5C2F1AA883466BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887171, "uuid": "67e9f069-7d8d-4556-a061-07737fc34122", "value": "1536:ACgJxbrHa1AobBfCOZNXNM5zbPCtyDytW8ilePhWsmtfEqa/4xOcAMp:OFrHabXN8zDhDyI8M9smtfEqawxO7Mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638887171, "uuid": "cde2d93a-16af-4f5c-838a-75a0536e5b42", "value": 128473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638887171, "uuid": "60396fce-2bc3-4ed6-8322-454b18459209", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887171, "uuid": "dee160fb-8159-4512-9a30-71044fcd49db", "value": "ce2ad65cb52d13de3ba4d016915ab162", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d34dc3a-57b8-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638920881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638920881, "uuid": "612a7587-a4e0-4405-8531-ffea66a35683", "comment": "Malware payload", "value": "f1ccdd89e4aea85b28984ae13579e5dc", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638920881, "uuid": "266f0d58-6cb4-4cba-bd1e-e75e32230d60", "comment": "Malware payload", "value": "dba5353ab99e0d16f30cf5ee5f1f160493b9a9b6364c71197e573f81e4145e75", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638920881, "uuid": "3356ca97-01a7-4bee-ba71-07bea5b95fa0", "comment": "Malware payload", "value": "4af676c3dfe68f58cc8e46957ada27f52346c26e", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638920881, "uuid": "2210c2e3-b973-4688-bc81-bd59f1e85ffd", "comment": "Malware payload", "value": "f811469930b95393bedada691ec50a2425f25f35bfd261fe691675d7b8bc710a638e33482096da206f2d706d9a4bc056", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638920881, "uuid": "cd675a99-1301-4f37-8197-8d8b4879fc31", "value": "T166C48D57F7C7FAB0E6BE827A86B1891C527774520260A78F674072896D23392493DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638920881, "uuid": "2618bdc3-dbad-40c4-bc76-e54b7e9f6237", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638920881, "uuid": "143f0634-a8ae-4585-8e39-ac3ba9f1f438", "value": "12288:jn/zDvGHAykHSzLW/4+8bzbBSreMd8JOgFK/UqW:rzbGHAzHAjX1b4cL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638920881, "uuid": "638ce5f9-f0d3-4973-b26a-4ce5adf71e8d", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638920881, "uuid": "d3149e5c-67ce-48d0-9c58-fc2fc4a8c302", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638920881, "uuid": "76cf125a-8f37-44c9-9452-82f940dfd1c2", "value": "dn1.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc1af2a-578c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638902088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638902088, "uuid": "1b490290-c366-4f63-9ae8-6b338a6f2ea0", "comment": "Malware payload (Mirai)", "value": "319c4cc4700995c2d46ed11633047b8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638902088, "uuid": "294afa8c-1917-4fe6-8a22-369f7224e139", "comment": "Malware payload (Mirai)", "value": "dbb32e2481b033facf4a68729681ee6de08aee9f5407eb4ae32ca91220ebecc3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638902088, "uuid": "74bf8906-6afe-4515-a6a3-431d91b9f1a0", "comment": "Malware payload (Mirai)", "value": "474b4dcee4137047aae6c71e76c7cec2bc285240", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638902088, "uuid": "328bb2cc-e9c6-4731-8084-0dbbb3feb420", "comment": "Malware payload (Mirai)", "value": "50d51eaae384fe54310dad1c81c236a7a648ec65445129f349af9b8cfeaaab3db0c4338aed54a62134799b74057da81c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638902088, "uuid": "b475dcc2-24f5-4431-9041-b8d03ec85876", "value": "T1D57386092E219F7CFFAE423847B78F259648339A36E1D585D25CEA011E7074E341FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638902088, "uuid": "a7ee60f2-0ddc-4e71-98d7-a3d7652357f1", "value": "1536:PCxBpGYuQsvvfINMvdaGuT+tp32xIogGrYzgp1J7:kLduaMMGuYkxIogGrYsLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638902088, "uuid": "68751b44-9178-40d7-b03b-1a0ff2bfad15", "value": 75836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638902088, "uuid": "9e33405a-22b1-4180-82f8-b148a20dd15c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638902088, "uuid": "8c98fe99-b1a5-4cc8-a0ab-468b34ee67a7", "value": "319c4cc4700995c2d46ed11633047b8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0519cbdd-572f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638862000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638862000, "uuid": "0bc9d6f8-cf45-4658-a8cd-fc84936bb328", "comment": "Malware payload (Heodo)", "value": "96028e08e7b333aa05c2ce39221ea049", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638862000, "uuid": "a491feb7-cf88-4641-bb4b-2202c03dfab1", "comment": "Malware payload (Heodo)", "value": "dbc6d03d7f26776e0b960d790b016961e0a8b8abb317e3044208b7fb371c0247", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638862000, "uuid": "1d1fafd8-3218-44aa-9940-f99c33c6ee35", "comment": "Malware payload (Heodo)", "value": "e51885c8f435c9400120e049ed2755aead53abe0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638862000, "uuid": "e74b3529-53bb-47bf-9ee0-54cc6b553cdb", "comment": "Malware payload (Heodo)", "value": "57f3643f18b5690f6e591c3c294daeba21b7ca5cd0ff075d3bcda7f104d5faa41942f85853d820de20f9f458caec3255", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638862000, "uuid": "b8a2197c-371d-43b9-b49f-b543e27dec21", "value": "T1FFF48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638862000, "uuid": "8e5dbc50-c921-41b6-ae2c-2bbd6361fb25", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638862000, "uuid": "db0a0eb7-478b-471e-baf2-ff06a87b9308", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/M:JapiKiBEmj4GbOX399Md9J/0T+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638862000, "uuid": "ba0977ee-58e8-4a61-a47d-0072804b3259", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638862000, "uuid": "4556f1ac-6ccc-4a10-b265-8a8f7070c0b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638862000, "uuid": "26cead9d-29f3-4f46-9124-c644b0962386", "value": "96028e08e7b333aa05c2ce39221ea049", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6edf667c-5704-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638843709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638843709, "uuid": "19e88435-0085-4fd5-b9ef-306165f2f92a", "comment": "Malware payload (RedLineStealer)", "value": "53bd1244d2c85a2d90856079911eee24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638843709, "uuid": "46a5bb28-b3e4-42db-8be1-4139d9225f91", "comment": "Malware payload (RedLineStealer)", "value": "dc189a482f8fd5ddd6e8aa505e7911bc6b368bb9ff97de0b05713a97489809d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638843709, "uuid": "c2c9bce6-57bd-4905-b309-3def8b53cbd4", "comment": "Malware payload (RedLineStealer)", "value": "48bb7a1466cae478076e2b64f5761a0ea0bf61af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638843709, "uuid": "6a4f3274-48f3-4795-84dd-c8dc2eaa2322", "comment": "Malware payload (RedLineStealer)", "value": "480ef9dc4e2ec634263a3ea17f5a4b59190e16aac07c1f88753bbfde46e64b996895fb189b15830861f03872a705bb80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638843709, "uuid": "08e76fa7-56b7-4f4f-a13a-155a1e1fc885", "value": "T1A9648D10A7A0C435F5F712F84AB997B9B52F7AA16B7490CF12D116EA5634AE0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638843709, "uuid": "01b2dafe-e437-40fa-822a-5df3b5425beb", "value": "9a4fc332982336bed32e6b1dc80be347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638843709, "uuid": "223c10ad-8e97-4416-b0df-45ae5f6a5466", "value": "6144:hCqcvVgvfx1W2142zq/1mljq7ycvF7vFGNr:h/cNmfzW2142zq/8ljmvF7v6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638843709, "uuid": "1f4807d8-cd1c-4537-a886-122c6b6c6c47", "value": 326144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638843709, "uuid": "2cea058c-548f-4070-952d-18d5f7d63a82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638843709, "uuid": "1b7ef436-2816-41e2-90ca-68d22848c744", "value": "53bd1244d2c85a2d90856079911eee24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5197e290-577c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638895199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638895199, "uuid": "e7795171-5102-4da8-a8a0-be230d3c3bbf", "comment": "Malware payload (Dridex)", "value": "be6910686587fe6e152b7f6aa1643e64", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638895199, "uuid": "061fa0eb-2cbe-4980-bf6c-e4f34e74e6e3", "comment": "Malware payload (Dridex)", "value": "dca1061b4c3303f5d09fa47ecb70cec7532ecf1f6205c622a34386f5e2d0a1ee", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638895199, "uuid": "9b59d983-1dd8-419e-bc90-5d4d1ea02ea4", "comment": "Malware payload (Dridex)", "value": "92da4733157b0b794c03a3338ff1a7436b7a48f5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638895199, "uuid": "c050d92d-7b34-440c-b5d7-3e3982709d4d", "comment": "Malware payload (Dridex)", "value": "682097b0d8d12f6e48975a2248c308549a3e8e4d27d6f547343c7e6be71d1f9055d3e3f5e11917c2a3d0a198a5cf36cf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638895199, "uuid": "e852efb0-da29-4655-a357-92d0ff4cef21", "value": "T1CD14C5957BABBAF5C670F6768D9E159097B3DC02162863FF248072283FB05F84C4C699", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638895199, "uuid": "13940713-198c-466e-8fda-121a6ce7801b", "value": "6144:g96FE76hr0d3n98AdwL3x2bVyyKC7AFjM8L60ddAY5gjwr:nrL60dOY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638895199, "uuid": "5b11931f-97f6-4bb8-9afe-6842f54ce7c1", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638895199, "uuid": "4d111bf9-8c2c-4d92-8930-1cd5188fa566", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638895199, "uuid": "075e06b1-bac4-4feb-b095-9e56aa0e8f1f", "value": "SecuriteInfo.com.Heur.24222.24366", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c31ef8f-5756-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638879004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879004, "uuid": "d9a0e823-0acc-4e29-977c-312396c93e5c", "comment": "Malware payload (Mirai)", "value": "bf78cbb4afc9badbf676e2db6f3f795f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879004, "uuid": "b4b38af8-a994-4360-95fc-e1f836e0fe84", "comment": "Malware payload (Mirai)", "value": "dd19f80419a9dfe235d8120b0aefae8744dd9ba5dbc2531afbdb5497daed14f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879004, "uuid": "e21bb78d-cb68-4938-970b-ed6ad1b05632", "comment": "Malware payload (Mirai)", "value": "a237b19a3c6fcf73fe36807ad73fcbf7a1a445d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638879004, "uuid": "84a65e54-3690-4a9e-a87d-ba424755c68e", "comment": "Malware payload (Mirai)", "value": "4cd501d7f9457bd3817cbed71ae4ed246f884f2a4d48c9e5bb89b74711e05ab6ee2231ba392fa2f5e5c9a4f671ad229f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879004, "uuid": "f5c0e655-cf74-4b6d-b68b-eaeebba2f17b", "value": "T1AE63F996B8C18E11C5D512BAFE2E018E3312676CE3DF72139D206F146BCA92F0E7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879004, "uuid": "d91c4cc8-ff3d-4015-9b08-5e68322e5137", "value": "1536:aAnTyJkaYXDbUwr5NFLBKLs5WH1f3wA3uc5IaiyEUmssBq7xo:gmai3UKzFLBKQ8HB3JEUmssBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638879004, "uuid": "be1b8de2-8300-40ab-801d-da507f248e9c", "value": 71076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638879004, "uuid": "efb8dd4d-d828-4395-b52a-447872f6112b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638879004, "uuid": "571c4baf-08c7-4b81-981f-9d3d90754755", "value": "bf78cbb4afc9badbf676e2db6f3f795f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c3ca70-575b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638881026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881026, "uuid": "dbe585b0-91ea-482f-acf4-776eb58e4017", "comment": "Malware payload (Formbook)", "value": "0da8bb27087d7bcfba59f2ca1dca4e86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881026, "uuid": "1b8290e9-bb34-4355-a2e0-2c1e9dd76abc", "comment": "Malware payload (Formbook)", "value": "ddae9e103982ab3a95b3095094152dca4f4b838dadc4c6128032b8e78f4d2059", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881026, "uuid": "ba751b17-1d95-4aa0-b360-0ad5435e6ccd", "comment": "Malware payload (Formbook)", "value": "994c1435e4899689446901aa5c627bd581913017", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881026, "uuid": "e4e7a179-c89e-4f2a-b283-82bd56ed6953", "comment": "Malware payload (Formbook)", "value": "87d83787655a41c35ceafa5c7fd57692c6a778222c9eb9ae59accb319e8e37d2b5d909c6624f978ca1a957dfe184032d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881026, "uuid": "244d09e4-4372-4060-990d-1c02a347ecc4", "value": "T14FA416852046B769C6160B71B796D01E4FBB58BAA9C2850F36D57EFEB7AC00DD30312B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881026, "uuid": "664575f6-d03e-4159-80d7-a94b98a79332", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881026, "uuid": "8a3023d7-c788-4d5f-b3ad-5a598864a88b", "value": "6144:yGiJ2uaAJScHj0N86PENZPsvtdS1DUFK+dNhxbs6cMiU4E5M1q/XjnfwI5mRd7fc:p8ZElEhU8+DsPMiPE5MUTn15G5fc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881026, "uuid": "459a9de0-48e1-422a-8fba-8e951d3a9f46", "value": 487523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881026, "uuid": "3d66c491-7f94-4e30-a422-e47413e612fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881026, "uuid": "eb0ac0dc-316a-47fc-87bf-58fc38532e4f", "value": "0da8bb27087d7bcfba59f2ca1dca4e86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92afc1ee-5772-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638891014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891014, "uuid": "83f869eb-6ffe-41ac-af4c-a7a2f26a121e", "comment": "Malware payload (AgentTesla)", "value": "3bba3891ad65c2d9b2a1c087a28ec600", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891014, "uuid": "1a47661e-0dfc-41ce-a23f-2d7e065dac1f", "comment": "Malware payload (AgentTesla)", "value": "de210aade840211f172a4bee93faac998d0e53ac9f2f1f06c69e6f994db0aa23", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891014, "uuid": "16d413c5-378b-4581-9dfc-7c84d96dd414", "comment": "Malware payload (AgentTesla)", "value": "956be1c920b5ff4f0bed5fb3d34f48b9688bf23e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638891014, "uuid": "3b3575fc-7b7d-4bc0-9fb9-1373a9f9d327", "comment": "Malware payload (AgentTesla)", "value": "4094be08a548e831e16c52e5446b12c91126394b08423401e2485325aafe7a3f4eb2aeda24290340ca7a727b6bfd1d93", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891014, "uuid": "b32c73c4-f6f7-4a51-90f9-fba69dca5512", "value": "T16C62736DC0AB01988F89ABB82727AF4501CC7A1DF3859A333678677567E1E3A5017C3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891014, "uuid": "e63cb6ef-d00c-49de-af89-344c89f52263", "value": "192:KJlEwC5HrCdlEzpD0KKMgq5Iuiny/VwMxqXdnhEbt2wRgD9:KJldCUd2SKumIVny/6K0lhORQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638891014, "uuid": "bd746a28-2892-4e13-aa81-35f2bc7ccf8e", "value": 15443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638891014, "uuid": "56234b68-261d-48f5-8bdf-987ad7fcc1cd", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638891014, "uuid": "826c11c2-a748-42f6-97f1-7403d21db0a2", "value": "PO-623562445_.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b9e2be2-5725-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638857823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638857823, "uuid": "b1f78936-3ff7-4067-bd8a-182968e18e7d", "comment": "Malware payload (Dridex)", "value": "90d8f3e52af44b5dafa4151c0cfb44c7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638857823, "uuid": "95963f75-d3bc-45c4-a9fc-6a805f77a672", "comment": "Malware payload (Dridex)", "value": "de8496ed6b3b34b3ed7ca989740397f46cfd313e1b2ed015b8e5f6bd1a92c8a9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638857823, "uuid": "83821fe3-b148-4369-83c2-31b9cfc92ea7", "comment": "Malware payload (Dridex)", "value": "2b2a6793801f675f29794716b7d6585f27638cb5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638857823, "uuid": "eaa486b3-aaa4-4f7b-a55d-3f69da13cbb6", "comment": "Malware payload (Dridex)", "value": "0c6fd7ccb3fadc6e94f52eadb13b934093aedf10879096c4686d726c53b9483fd2df14847d7c1b2f8402ebfb7fa79fa3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638857823, "uuid": "7a911430-42e9-416f-9582-f54ac8f59bce", "value": "T129C3F14944074CC5C8B772B7422955F67B0E0968ACBBC35B64B4AE2C506E387C3DAF97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638857823, "uuid": "bff72d11-adcb-427a-b29a-b76962e586bc", "value": "3072:JHy406FvYHmvKrguyzFq8fDb/DNijhtc7dll:JqwYHhgVBqub/DNMc7dP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638857823, "uuid": "2e4a058e-ae97-4802-b598-7b898963e443", "value": 123095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638857823, "uuid": "baf34f6d-aef1-4587-aaf3-6c50af391a1f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638857823, "uuid": "76668e45-ac47-4417-ab33-956804403cce", "value": "act changes12-2021-268879258.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e0ff5f-573f-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638869227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869227, "uuid": "82d4e80d-d661-4d78-a699-48cf225643fc", "comment": "Malware payload (AgentTesla)", "value": "5f5f195b25d9dd75e0669df710faa605", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869227, "uuid": "8abdcdb9-b509-4c38-be06-9671f49f2430", "comment": "Malware payload (AgentTesla)", "value": "e10f1259784c2157a2c52bee8275285fe9b213f8cec801debec8ffbd80617bdc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869227, "uuid": "18ef7d2d-87b8-45e8-b9e4-c984d7c121cb", "comment": "Malware payload (AgentTesla)", "value": "3e92f7cfec78aa221a1c50cc0b99136fb28b6aba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638869227, "uuid": "22b64feb-fea2-4ce4-84d9-ed0109a32460", "comment": "Malware payload (AgentTesla)", "value": "e08e07141bd8d0931ad597f790db5995a2fa953399ac137885f1a4301a3f4ac6bd264dcd546f1c177785c581c6c30e9f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869227, "uuid": "a71fd64e-8586-4501-a93b-6513300e0c36", "value": "T1356402E1455C91FAE9271BB08616CA6A2EBD7FCAE640E227755BF09B4C773C4B03050B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869227, "uuid": "6733a0a3-6cb9-4e32-8021-c37fadb1e4b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869227, "uuid": "aaeab12d-e978-49ca-a673-4c6fd05db431", "value": "6144:tJnlNlvwvo+6bWY0QB5N1ArKE5jbXz1nEwoOdZ/lBFjCDx:/nnlvwv6agVmrFDZnCyL7ed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638869227, "uuid": "f839e9d9-ef1a-4f47-a643-21c4dba20304", "value": 322912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638869227, "uuid": "3b2c6677-2fd2-4845-8e73-5ae90ebcdc9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638869227, "uuid": "3b99797e-3158-463a-ae18-a8d9db20e3ef", "value": "SWIFT ~0.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ffbee67-5799-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638907571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907571, "uuid": "9698193e-81bc-4fe0-92b4-9a9f189dc8e4", "comment": "Malware payload", "value": "0b30c0f5f74f01e9fd9660cb0c9a932c", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907571, "uuid": "5271e378-434f-4099-94ba-332ff8042622", "comment": "Malware payload", "value": "e20204472b71e521c424c5f302d8dd50cff9aed23df72728101b4142dcfdb8b7", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907571, "uuid": "07b790fe-7d2f-4180-bfde-7dae03211226", "comment": "Malware payload", "value": "5ee95edc6d325913517c59e78965e53e58b624cb", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907571, "uuid": "54243281-4d2d-4725-bcac-9c4b5a65d535", "comment": "Malware payload", "value": "7fdcf6de5b3cc99ba57bb787179d312c27ee36cade9d0ea46cc4852da01cf66bd5a9acb93fe19334cf6bafb77fc9cc62", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907571, "uuid": "eebca78b-95bc-4363-a213-fc789caf95cc", "value": "T15C3522BC769766CDC5C5037A377A606883763C768567C1ADE0A9360F493BB01BA33A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907571, "uuid": "d76044e3-5932-43c8-bb69-9a7339c012fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907571, "uuid": "dda98d6d-84cd-4452-ac19-84d1471259b9", "value": "24576:79mA7942SSaa4EeFYU98ZSiLC1LrtZS0Fsbpt0:p9p42q1FtiLMHjDFsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638907571, "uuid": "2ad52255-5150-48ab-8525-73229ce02658", "value": 1082368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638907571, "uuid": "d7d09bcd-fd16-42fb-9753-6ebb728c45f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907571, "uuid": "d4bf1dd7-9a6a-438e-8012-fd336c06a126", "value": "dhl_doc876545678909876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4dc750e-5770-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638890292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890292, "uuid": "eeab0346-e3cb-41e6-8314-d2aa534a7bc0", "comment": "Malware payload (Heodo)", "value": "9f839103f2c0cbc8578fe48bd505901d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890292, "uuid": "7d4e5aeb-bca7-44f3-80f9-362e73e1e6b4", "comment": "Malware payload (Heodo)", "value": "e203b4723ab1766881e9edd9026370125fc026114b2adc5e90bd21a995eb6474", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890292, "uuid": "ea0877cb-d8dd-47a8-970c-17326dcc7143", "comment": "Malware payload (Heodo)", "value": "443c0d7282433b109e6621d4ea04eaacfb3cd1ed", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638890292, "uuid": "4f708d72-5825-403f-a979-a5eda4a97700", "comment": "Malware payload (Heodo)", "value": "42ce73bb5bb4d6034ab25792347e11e16c8b3169a7f46a206ff0729f9e1a63ed20c51c914404cbe433fb8f197d62c529", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890292, "uuid": "816b225f-a489-423c-9801-d62dc2a82689", "value": "T1BD24D0B171808439FEBF66385D34D1845BAEBD90CB21ACEF7604019B9A685C08F73D7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890292, "uuid": "f33bb04c-e87d-4f40-96a2-f211cc31a901", "value": "35dc3f1eb8a03291fc0dc93396a967d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890292, "uuid": "d2fb1630-53fa-48ec-8788-854f270ca609", "value": "3072:MCDoXOpFVtI8/7gsEKr8x7tiUabb1mVDtgQhdYJBoo31kCsIN7Giz+w/gnViasLI:MGoX+VtZ/7vEKrWpwobqWo39sjC/Wss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638890292, "uuid": "c72aad5c-1d1f-4816-aaec-ea2dab303035", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638890292, "uuid": "da37762b-5ea3-46cf-93f2-f71b0f5cc9ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638890292, "uuid": "fc683587-2d78-4a71-a2aa-62ab69b812b2", "value": "emotet_exe_e4_e203b4723ab1766881e9edd9026370125fc026114b2adc5e90bd21a995eb6474_2021-12-07__151806.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "051d8b25-5751-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638876603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876603, "uuid": "7d9b838e-db10-4d59-87b3-f5f88e540dc4", "comment": "Malware payload (Formbook)", "value": "e351ba405cee1f0594aa743dc248b1ba", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876603, "uuid": "4a151da1-8336-4a32-a2fa-376b59a885b3", "comment": "Malware payload (Formbook)", "value": "e22dde0bf08c6cddafbc0f6630c2ca0185fdf929ca9239783bb7c17686c23122", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876603, "uuid": "367ae6b2-510d-4ff8-b4d5-1bc421e8fe88", "comment": "Malware payload (Formbook)", "value": "6b417529c0d93176efe16900a3c49dce62964c54", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876603, "uuid": "ed15998f-46aa-490e-8e59-06eebfc6f686", "comment": "Malware payload (Formbook)", "value": "93665b95e0a730aecad995af28f86e695984a586a6e01e2fefc7fc9090a99e1018792b45a159dd50a7f27c201c31f6de", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876603, "uuid": "dc51a9fe-9d97-452f-b3aa-76bdd9b3b29e", "value": "T176341256BE27D712E1128CBD5EDE4CA883B5EDD71B83CF8736713A4C47B888849042B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876603, "uuid": "152a3cbb-00a6-484a-9083-eb7ff80830d7", "value": "6144:gTdhyZOEEwz2DADUnB//2cUIvPLeZm/pQuIxj+rp5+:g5hyvEK2sDeB/uc9L0O63jAP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638876603, "uuid": "d3b892b5-c1d2-4258-9e46-b85d0eb45048", "value": 234616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638876603, "uuid": "9f63d840-438d-40c3-9d49-b84169864c56", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876603, "uuid": "86017684-2444-41a7-b2a9-85c378bbcd4d", "value": "QUOTE.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ce5450-5762-11ec-96a4-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1638884202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884202, "uuid": "572cbb92-9e62-4fe3-9ac8-9a56710adb1c", "comment": "Malware payload (GuLoader)", "value": "a1ef9ae315f61b2c59cc43395363ba49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884202, "uuid": "4b5daabd-bc8b-4b65-b87a-392d8fd12d0f", "comment": "Malware payload (GuLoader)", "value": "e2c288d4d46d6309e65db6badd3bd1adadee9544a594d77a98eb8408ab1cd550", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884202, "uuid": "998df1da-8092-480f-b380-653745120cde", "comment": "Malware payload (GuLoader)", "value": "f23a59a7d5e61adc8549687c23b100d452dda315", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638884202, "uuid": "beb81215-ce26-4f80-a03f-469dbecfb58f", "comment": "Malware payload (GuLoader)", "value": "47164a41de76a729af1f63ed9fb2025884a7528f242ebd12d9fc6ec717d5b974a1c9fca94604a06f57b10fb1a1d6c506", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884202, "uuid": "9ed4fce2-9331-4c89-9215-ce96ed6b4a36", "value": "T1C2E35B16A281E2D9D15DB3B5DF26F19C50A9BD37380118CB9DC63A5C0B38B4395EB31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884202, "uuid": "1114e07c-6c4b-4e1a-8c41-9a1e83e2afd8", "value": "460340e2ce791b610d6d419830ceb88b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884202, "uuid": "4221a860-2034-4aa8-96cd-fdcacef49b42", "value": "1536:A4ywU+y2dOED1ffNoZHSzIvsNNZ9mCEVUr7Kz:IwJy27DtfiZHUws/mZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638884202, "uuid": "d7bbb443-18e4-42c9-832a-b5094c92d36c", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638884202, "uuid": "f22e77bb-8d7d-4767-ab9f-04eb1519a13b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638884202, "uuid": "b517a9e1-4292-4d59-87ff-525a99ea31c3", "value": "FACTURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e21f9ce1-5702-11ec-96a4-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1638843043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638843043, "uuid": "de8d4e3d-4d80-43cd-8636-80e852c4ab24", "comment": "Malware payload (Amadey)", "value": "9801da7c6ea06dd8c9e7cbcc872b97e8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638843043, "uuid": "09a2ace8-9810-4f67-82ab-40ea3d883f48", "comment": "Malware payload (Amadey)", "value": "e2d05e5660b4cae33a0283efa07c052bf7f2c776e782004e8f690bbf3ae6f48c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638843043, "uuid": "aafcf555-1c4c-4625-90d5-752de370c3de", "comment": "Malware payload (Amadey)", "value": "58c08605d3f1b5d12c282ce7867d6a27082a405e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638843043, "uuid": "2e659880-48c2-4ca9-8352-85378db67178", "comment": "Malware payload (Amadey)", "value": "08cd40ba926eba855d33584c2594a5106074fe9547cddeca5f78b48c2b92aa84cc604258abd307128df782bd108f3e0e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638843043, "uuid": "640b4ed0-ac16-4b0d-9dd5-6ad6de567c68", "value": "T1AF349D1132C0C072D01324798969C7F25A7BB8756A769ACFBBC42FBE5F246D2DB25309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638843043, "uuid": "5062f2e4-094a-467f-a134-8a6e481a04a4", "value": "3e040a184666b793e8b84904205dc569", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638843043, "uuid": "b3dc3f4f-f651-420e-852d-0c1e0933c319", "value": "3072:wqiJ4UamhM9729Oq8JiTXurHWLDT+OJLCV1q0ffgd1X59p:biJ4Uamifuurc5JF0ffwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638843043, "uuid": "c4938696-d788-4709-9b8f-d14d7e3dd4fe", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638843043, "uuid": "4f0506a3-dc9f-4d99-894f-c10883b767ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638843043, "uuid": "6cdedc2c-3a49-49b8-98d3-b8c35601cc2e", "value": "9801da7c6ea06dd8c9e7cbcc872b97e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "153b7f11-5784-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638898534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638898534, "uuid": "c2258349-862a-4489-bff6-5b259af76e0d", "comment": "Malware payload (Heodo)", "value": "c884df4a9d4c1d904c450810fe18b29a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638898534, "uuid": "5103f89b-33a7-420d-ab94-52177c98088c", "comment": "Malware payload (Heodo)", "value": "e3231f217203be42e8abd459f7009824cb35fea2b6fbd6361545a3f6e118abc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638898534, "uuid": "9b26788e-1345-4637-b2a9-abcbfcb0fe1a", "comment": "Malware payload (Heodo)", "value": "d5ede74820a7a7d6d79be6a1c89a9dee4bb53cb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638898534, "uuid": "7e0bcb06-b654-441f-a4ef-b6a930794cc5", "comment": "Malware payload (Heodo)", "value": "ad093c7169c706987ba9cec935873465a5bdea7cdc23e6a73e68b5e3debf409890099e31d52d5a03018bacdfa0617f60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638898534, "uuid": "e7d24cae-124f-4509-aa35-8312a21fe310", "value": "T14D24D0B171808439FEBF66385D34C1845BAEBD90CB21ACEF7604019B9A685C08F73D7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638898534, "uuid": "59f71abd-bb95-4497-8d05-f11f02f7e8f8", "value": "35dc3f1eb8a03291fc0dc93396a967d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638898534, "uuid": "1e4f0928-1572-4fc0-bb46-3f1538c5a404", "value": "3072:MCDoXOpFVtI8/7gsEKr8x7tiUabb1mVDtQQhdYJBoo31kCsIN7Giz+w/gnViasLI:MGoX+VtZ/7vEKrWpwobaWo39sjC/Wss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638898534, "uuid": "23ff1761-422f-41c9-a34a-d0ac1e95b385", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638898534, "uuid": "bae1034d-451b-4e08-bbea-617320a2d60c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638898534, "uuid": "66da53e8-8be6-46eb-9c01-6d4661e54380", "value": "c884df4a9d4c1d904c450810fe18b29a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc422b72-57b8-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638921148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921148, "uuid": "ffb4579d-8e6c-4ca1-a20f-bd20dd838820", "comment": "Malware payload (Mirai)", "value": "e20091857acf1d45cc0029756397545e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921148, "uuid": "feb141a7-b007-4b8b-ab58-95809f7a6e04", "comment": "Malware payload (Mirai)", "value": "e47417ec89e65298ae067aca6117b03d039bf9056835f93d0250f24e625f2cd9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921148, "uuid": "f6265f82-594b-47be-906b-f359f4e4dc75", "comment": "Malware payload (Mirai)", "value": "ca90d5d1d09752158783188752a2bbd9f372a64c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921148, "uuid": "ab5265a3-8d4a-4a92-b540-c79b43300ffe", "comment": "Malware payload (Mirai)", "value": "9479dab9a38796ef04bf2b35e04a8f9d1206089897c7b7929f0f6bc9617196749af4a6b76f92a063551e939f9b616555", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921148, "uuid": "c76ec585-36d9-4ce6-8dc7-869cd3605545", "value": "T10BE2E178970248D7DCAB88F1027727462F538BF2B817A8569211F19FB50E4EC3857BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921148, "uuid": "3f834a32-af1c-49e7-b3d9-ce76f5e00083", "value": "768:Rp4cMyZv4n/Fj3bRm82O2CAwZEsd8mqmoMJgGlzDpbuR1JJ:vRctmNO2n6e3EVJuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638921148, "uuid": "c15230c8-b96d-4319-8eec-8d534c52e363", "value": 31124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638921148, "uuid": "e6fab9c3-bd8f-4f94-9029-42c7fbfe18b6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921148, "uuid": "db3864e2-b76d-4e7d-a876-5ba7b96add21", "value": "e20091857acf1d45cc0029756397545e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3138cc-5759-11ec-96a4-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1638880156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880156, "uuid": "8914c466-b8f0-43bb-8ad9-bb374250fc49", "comment": "Malware payload (AveMariaRAT)", "value": "f9c10dc1e0d3c6cca07a5f5ec2d4196f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880156, "uuid": "a16a44e7-26a4-4c48-b89e-9fa991fb7126", "comment": "Malware payload (AveMariaRAT)", "value": "e53117bb9ee3d0c9bfd3d94758b9d54c824776bc594549801bcae621962590fd", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880156, "uuid": "3be12c97-a010-4731-88a4-102cc9af07a9", "comment": "Malware payload (AveMariaRAT)", "value": "6e8be70e89da8f5696f96d0cb1c2e5104ed65731", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880156, "uuid": "bc7b7795-1a8f-4bc4-9a76-73fe08b00379", "comment": "Malware payload (AveMariaRAT)", "value": "a74554b7690e2a3e180bc099c75c5107d239d2b57502bf9d3489d65c44d77e54c613a7443fee0286a97d3b14dc32c230", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880156, "uuid": "fc573fe4-0739-4dce-a1ec-a9898c744594", "value": "T139C40519B5AA73AFC9ACB579D0D1F0328737B60B8DB4DD71B080D98609F48799B2508F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880156, "uuid": "cd6e73bc-8e4b-4b04-8024-7d3f70b0f235", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880156, "uuid": "8ae66917-cade-46d8-aadb-74c1d2de05c7", "value": "6144:6GipGIkU5uBRRRRQRR1OVtfqvCEqPOmwFUEDDkEgSzKPqEko4EHa2whSeiSaG:PFUYRRRRQRRmROl9ZFUEcGz+AoEhNaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638880156, "uuid": "411b6a00-c5bd-4673-bf44-0fc4b84e5185", "value": 548199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638880156, "uuid": "d144d4eb-d747-42ab-b428-cbcb2acba05a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880156, "uuid": "a832967e-f8f9-464c-aa88-d42e4f440151", "value": "f9c10dc1e0d3c6cca07a5f5ec2d4196f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeca6be5-575c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1638881719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881719, "uuid": "0c30af8e-8e43-4ff3-81c1-667195b6259b", "comment": "Malware payload (Smoke Loader)", "value": "f1f4b11986ec08e5b3e391e31b17bee5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881719, "uuid": "f2780db6-705c-416d-9378-182dd02503c5", "comment": "Malware payload (Smoke Loader)", "value": "e5b96b737e6f8ae8752fc771be49d56a2aa65d715c1674d5df5875e446a6b3ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881719, "uuid": "ad297a7d-5818-4198-9fa1-f0687ed5f723", "comment": "Malware payload (Smoke Loader)", "value": "96b1b2c5688b9b706e39f2e1b60a4f2b1023cef5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881719, "uuid": "257f8de8-27aa-4a77-a584-994eb3e7e853", "comment": "Malware payload (Smoke Loader)", "value": "f0e95aaa6228da83b66bc5666ef6e3e0119e77d491f2044934ec8bc1c0e602a256e3c0b76203fabdfeb5da346a9688eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881719, "uuid": "d3e87089-c31a-400d-ab97-1a01972370fb", "value": "T11B648D10A7E0D435F5F712F84ABA63A9A93F7EA1AB3490CF12D516E956346E0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881719, "uuid": "13a56022-a16d-4e5d-b59b-8829b7a6cf2b", "value": "9a4fc332982336bed32e6b1dc80be347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881719, "uuid": "18434429-7400-4dd0-a8d7-0c08728e9c5c", "value": "6144:TB8PdNyQvyxXsjJp4WN16ls1mq4qFSvvyY/aOU5:uyQvGsjJp4WN1668q4LvyY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881719, "uuid": "f1b1d1a5-bb8a-4cce-a0ec-91b0a1a2b88c", "value": 326144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881719, "uuid": "9ca97835-d7d4-4ec7-9240-527bd544079d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881719, "uuid": "c78e5058-c8d2-4438-be1c-0821171f6139", "value": "f1f4b11986ec08e5b3e391e31b17bee5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0272bf57-5751-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638876598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876598, "uuid": "03213d08-7b34-4071-b1dd-9625a74c321c", "comment": "Malware payload (Loki)", "value": "77c3c23bc20a83593171169e25685fe2", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876598, "uuid": "613810bc-12ee-4621-8fb6-d5b7abc4f80c", "comment": "Malware payload (Loki)", "value": "e7629c10d98b4f80232ed640a2232269bcd8a727b78f3c01dfc86a058ddffe8c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876598, "uuid": "45d5d727-1be8-4570-88dd-9aa7bfb36d1e", "comment": "Malware payload (Loki)", "value": "8c32fddb93ff0c85e010ca87807898816214ef7a", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876598, "uuid": "49f824ad-3bea-474d-98f9-329995e1aabb", "comment": "Malware payload (Loki)", "value": "0078b167be45812680ad5e677625b0de17642c94442e69b448fb7d3da2ce87f3bd5abb6563c1dfb7412310e8d603125a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876598, "uuid": "04401ab0-df08-493a-bfed-ebd01d8b16d5", "value": "T1FE3412E0E1C0D3BFCBBF05399987E415AD3FEC419489AAC558B9B49F4DF52294C283A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876598, "uuid": "83b8fdb5-3934-451d-895f-959dd43b2006", "value": "6144:8TTTTTTTTTTTTTTTTTTTTTTTTTTTwTTTTTTTTTTTTTTTTTTTTTTTTT0TTTTTTTT8:pzbu9ijEWrLqtAvXloV3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638876598, "uuid": "ccf8e6c7-787f-45b1-a704-0ae9479c2d3b", "value": 234552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638876598, "uuid": "2c13c95c-ff9e-4b2a-b490-d99f7228cde9", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876598, "uuid": "ac809f58-49ca-46e8-898b-bf58bdf5e5d3", "value": "Trail order and company profile.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc37418-573a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Hydra)", "timestamp": 1638866953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866953, "uuid": "520eef97-f5dd-4143-8ecb-465ba796dbe0", "comment": "Malware payload (Hydra)", "value": "9326a01f58049dcd9947e91c71972fba", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "torhydra", "colour": "#33F7B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866953, "uuid": "4101916f-2477-4402-b9a8-3f903b47f214", "comment": "Malware payload (Hydra)", "value": "e80cb43578f6a8b2ded95c8a2e86076f3661d60e2f18ebd1f094308e1d593c87", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "torhydra", "colour": "#33F7B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866953, "uuid": "1d98ecf0-9eb8-4dd7-88b0-3125518ab8b9", "comment": "Malware payload (Hydra)", "value": "6686eec12836e010a929df0df3ca87b3d718d348", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "torhydra", "colour": "#33F7B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866953, "uuid": "159c595c-a1ba-4aec-bdca-17b0d5e05b6b", "comment": "Malware payload (Hydra)", "value": "be8c66b32565384a81e017da211739fb8644ca2d5fc3d7c793624379969d754c1d630086190728720cf5daa5a1faa535", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "torhydra", "colour": "#33F7B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866953, "uuid": "588ed871-2ca7-4574-b207-e773a534d844", "value": "T142763301FA51B2CEFFE51437275285068635AC981E12F8DBBCAD732E2F37AA05725C91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866953, "uuid": "8031ac22-d95e-4824-a26e-7202d029a034", "value": "98304:qKkDrOhNgdgC6j6DhdkFjVddWbRIdymNQn8ohd+rnR7Qw4Z2k7Aa3k4uHrLWOgud:kDahNBC6WCNZyZhd+tO7hDtMkuY6fnBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638866953, "uuid": "b1499929-e50b-49fb-b677-21491513d65d", "value": 7710776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638866953, "uuid": "19afc09b-d05b-4236-be36-efbbb2efff85", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866953, "uuid": "bd2c2f4b-b4dc-4365-8bdc-2d6e5f27f696", "value": "bawag.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7df8b79-5714-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638850676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638850676, "uuid": "ab0d718e-646d-4bde-aa0f-592fd1bd59f1", "comment": "Malware payload (AgentTesla)", "value": "47b58c5b9d5dce66bb30c25453bdc9da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638850676, "uuid": "4d370599-1a34-4513-a474-35ff0f06e1c7", "comment": "Malware payload (AgentTesla)", "value": "e80e20f7e74087484cf17b804194326c4130cc4b71d78a793b763b34178eb169", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638850676, "uuid": "d070ebc6-6e25-473d-a764-f6154fb6cb17", "comment": "Malware payload (AgentTesla)", "value": "5b3ff4d741ebe00801c8d66c5088184e8549e25a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638850676, "uuid": "1c3afaa8-816d-4a9d-a801-1edcea206bb0", "comment": "Malware payload (AgentTesla)", "value": "496746786eddbfff82dff703e53d59d3a975cd08e469b16fcc429aa1c0d5cd9d450266d28890b69d110b07f5bd7d7cd4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638850676, "uuid": "2377e002-ef90-4ce5-8466-3e7e4920cecc", "value": "T1E027E04936C6E6D8F87BFBF50CB0B1C14375F1D0F541E6DEED94259AA8A2B904E10A32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638850676, "uuid": "fc5e91d1-9b6b-4172-9c5c-80b2fa7b11a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638850676, "uuid": "4116687f-a526-48fb-81b0-ea89a46063eb", "value": "12288:cWma2iNRdH5PgmsYnlxCgxj2rSS9HyV7CutEd:cWma1nt5Pggx2hyIutQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638850676, "uuid": "701b2fa5-8be5-48f8-ae3a-7c92302de00c", "value": 20971520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638850676, "uuid": "113e0a26-5a9f-46c3-a334-7629b3733c88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638850676, "uuid": "bfa969f1-627f-4dd8-bd39-e072236978a2", "value": "GOODORDER.COM", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "706d542f-575b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638881078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881078, "uuid": "21e18ae7-793d-40ca-8570-307ca0e21819", "comment": "Malware payload (Formbook)", "value": "84ac2194908e10d3a474dfc1296c39d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881078, "uuid": "ee662d01-251d-4dfa-82d3-192d4835c53f", "comment": "Malware payload (Formbook)", "value": "e882234db612d0e57bed4b0ae32a2b0dfd70af4721257c5aadb27c9459252a8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881078, "uuid": "e4d7c7b9-8904-4cd2-8e7f-45048171940a", "comment": "Malware payload (Formbook)", "value": "69788eb708c2172af42e99efc6c3390bc5cfcc6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881078, "uuid": "7487b2ed-c5fc-40ac-83b0-4bdf30e7c4ee", "comment": "Malware payload (Formbook)", "value": "498d21a42d26ee9cdde1dfb00e8cc5e413f846bf43000c5518ed917833fbc34a5cca5a2ab324da3c2c7f631ef0c7bc72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881078, "uuid": "8ffa8a90-bd8f-42e1-9e24-396296127836", "value": "T1432522BC3AD366CED15047B973A64078A2366C3A540BD19CD49E739B2C73B46B933623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881078, "uuid": "d6c9d0df-de8e-4e84-88ff-d3e5123672aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881078, "uuid": "7a18dd10-0142-49d6-ac51-963fc85f11d4", "value": "24576:v0sqfeUv8kxy8LLUmDSN/lOWOqZsDzsaulhQLKeVpgxL5GdB9A4SsO:cNv8Yy8LLUmDS1sWvEsaBeeVAO9A1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881078, "uuid": "e7eb299f-7b08-46c0-a0f6-f9b4d7ce283c", "value": 1025536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881078, "uuid": "0858528d-d563-419b-857d-f048ef34ee8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881078, "uuid": "0f00567e-2e16-436e-8220-401064958a96", "value": "84ac2194908e10d3a474dfc1296c39d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ceb2fe-573a-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638867074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867074, "uuid": "de1e9358-e1d4-47a7-8e8a-0c37b5a35a85", "comment": "Malware payload", "value": "0aab77bc7f64be6100de694efd5b5572", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867074, "uuid": "238ff8df-797b-4ebb-8d60-8a15d376fde1", "comment": "Malware payload", "value": "e910e6a15d55f7d7dfb449be9e6508281254d1e9a6e85aa0997e53a075d13ae1", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867074, "uuid": "25ab153e-1c9f-4af7-96cd-691b3f24e2b4", "comment": "Malware payload", "value": "221429dc81244fd1b052bbc83952f6b499962912", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638867074, "uuid": "a45df094-04b9-42b6-90b2-2598b68f44a5", "comment": "Malware payload", "value": "5369c3a5180a60622d012df26039f9ab2f906bf82b5103ad5cd1dc1b71d860ffc537805f7c5c86a9b0d76eb16475ca18", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867074, "uuid": "b9a9060f-e843-40d1-b7f9-b89534056897", "value": "T15B85338D732AE11F944CA67EB42492BC09257425A195BAC433F9374B4B7DB72F2CCC92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867074, "uuid": "526f5914-7cde-429a-87c8-5a058f2b5c24", "value": "24576:5mzqGNNgeOqQ7rqoLMCgxbBKbAgok16DFWnIfG4hQgu6j/hmsQGEhMr09uAFTOaH:5AkeUQbBKbA3/BH1uSKGEhFuJkqkFyyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638867074, "uuid": "5e1767b0-04ae-4ef1-ac26-789a0f120349", "value": 1822500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638867074, "uuid": "f9431d5b-d14d-416b-a444-3bd2a85b2929", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638867074, "uuid": "ba7e791d-fa76-45ce-b981-ed53065d2051", "value": "Nov SOA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702f98c4-5759-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1638880218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880218, "uuid": "cf15e335-1d14-49f1-aec0-4bc685147bcc", "comment": "Malware payload (RemcosRAT)", "value": "d5f570694f0847caea18ccac8837b052", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880218, "uuid": "3fd3178d-cdf3-47d2-b079-5f2a72cdf9fd", "comment": "Malware payload (RemcosRAT)", "value": "ea209f6ba95920038ac83985be8bcffc1fda49631ed3142cfdd9f2acd52584b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880218, "uuid": "88019bbc-c437-466a-8082-195536dc82a6", "comment": "Malware payload (RemcosRAT)", "value": "b509737bb61ae0e9dee56ca2706456b3788ce553", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880218, "uuid": "dd46a6a3-8ed7-4f3f-b3d4-7eb6c68a0309", "comment": "Malware payload (RemcosRAT)", "value": "b75478a55d5469b0c52c41c2e4266ccae341c777493c7ceebb4e4d42a6d940a4aabe10290ac6caa9ae53f465ddbe191e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880218, "uuid": "374ee6bf-8a56-421f-8fd3-ad892424ac99", "value": "T1AC05D0C2DFCE561BCBABAC3510174CB7D1439B4ACEC061D56198EA2B58722EBC1635CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880218, "uuid": "d4adc787-5555-49e1-bbfd-b6561f52c536", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880218, "uuid": "66a53906-4263-4608-937b-354e9adc16fb", "value": "12288:O46yDv/k496AZOJnBH92K6UXi6ft27rNG1JbL1pywuWKDaFIMD+o4Sth:OvyQVA+d2K66fgZGDXmWyaFHDtHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638880218, "uuid": "840f3607-00e2-42a8-9efb-67dda5bcc5a7", "value": 833414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638880218, "uuid": "c3186032-34c1-4fbd-b69e-c551e7ebe826", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880218, "uuid": "51431baa-f25f-4d32-8de9-18677076ecfe", "value": "d5f570694f0847caea18ccac8837b052.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d24d2879-575c-11ec-96a4-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1638881671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881671, "uuid": "717f41ad-c21a-4075-8b41-5f500ce3c45e", "comment": "Malware payload (AsyncRAT)", "value": "16f110b124d0b30fbffeac0a1b3e0f64", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881671, "uuid": "ffc8699c-c918-4a5e-9f1b-3a9bb494d1e6", "comment": "Malware payload (AsyncRAT)", "value": "ea5f4670002af8c3383f591d38b2ed912d1d2e144df8bf59d849e5c77e9c7de8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881671, "uuid": "04f476b0-d338-4985-825f-02df33d0c1b5", "comment": "Malware payload (AsyncRAT)", "value": "b3fce7935a3411d1c4a89dab3e1b1d9c6f3422ec", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881671, "uuid": "0b5f8ab2-a4d8-46dd-aac8-3a67a1ca91ca", "comment": "Malware payload (AsyncRAT)", "value": "2c43b453dfd9d20afaaf7a4167806581e43e401a6d685891ac7575a1f8889d4b8782875f4c99f7c9e933d1f38b867e68", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881671, "uuid": "9c5a2bf9-e8b2-48d7-ac84-f3d6b406bcd4", "value": "T17774BE0526D5D6A8FC7FE7F90CB071C20375F2E4E681E6DEEDD4246A98A2B944F00672", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881671, "uuid": "58921af9-f3c7-45bf-af15-664e523b7543", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881671, "uuid": "d8e6d952-8bda-44c7-b093-0eddf417e8b0", "value": "6144:ycQWaNJmWFRSUa2GhNrKfSWCSL/8kX0t782iKSwtP99AzeH2Bfl:y7la2iNrICAcAchuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881671, "uuid": "4644b307-2649-4121-9a3b-ff9a0d3188e6", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881671, "uuid": "0847c5d0-6ea6-489a-9e23-f74013115ce3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881671, "uuid": "b7b43ff9-1ada-4015-97b9-fa84127b6795", "value": "16f110b124d0b30fbffeac0a1b3e0f64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1c49a3-57b9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638921529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921529, "uuid": "73805718-6cbd-4d21-a60e-24b1a7dbd311", "comment": "Malware payload (Mirai)", "value": "86cffcbcbc686407815754f3df4c18e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921529, "uuid": "19963e58-5d6f-494d-8219-9b4ec4438719", "comment": "Malware payload (Mirai)", "value": "ea9b05385c984269252503f7d5ded86e0650b7ebdfddf21a3b41f9513aeb25b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921529, "uuid": "713a0712-34c6-4c71-9ffd-d7efe91b2e85", "comment": "Malware payload (Mirai)", "value": "a2dd15947ed794e1cea3a4f635aa2fa971b7ec82", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921529, "uuid": "79eb3f50-60e2-4208-af5c-e670c70f1b52", "comment": "Malware payload (Mirai)", "value": "12955f8d2c292fcf5e5421c36c01d301bacae3226fa2a38b80c92be635e7ba69354099d2e547d16010ddbadc1c26dda0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921529, "uuid": "9d331f35-d6ac-4369-a97d-fba5a04aaba3", "value": "T17EF2E142134665B3E73264F2FD92CAC727160BF4E0CE20E2DA457655D69A2D12EDCF0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921529, "uuid": "6f6d44da-231f-4b09-a57b-f7ce189830ad", "value": "768:m2WTfRwfxSTjnCRl246UA2Qz4pZyZfCW25J7pQ7Z9q3UELxr:0TfhnL4hbQzaZianpQ7MLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638921529, "uuid": "bf8e0773-299e-4889-a1dd-7b488c02c425", "value": 34592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638921529, "uuid": "44efebf5-7dbd-4a29-9269-cac72e73484d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921529, "uuid": "ce08e7ad-2fe4-4e87-a5be-63f9518cb631", "value": "86cffcbcbc686407815754f3df4c18e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1e445d-577e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638896054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638896054, "uuid": "ad009931-1419-42ab-99cd-7c7495386278", "comment": "Malware payload (Heodo)", "value": "c6f3494064e025c03826c7c9a41affa1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638896054, "uuid": "f250c793-bff8-430d-adfc-1b843d6bca39", "comment": "Malware payload (Heodo)", "value": "ebab3a18bf406017dc2dec6f813b7cf7608b52d64365fd4d109149fb4a5801b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638896054, "uuid": "7c9e4215-0a7c-4664-8ae3-17ad89f66eb3", "comment": "Malware payload (Heodo)", "value": "e46adfff34ef125c7bec7c32b6c1c982c93764ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638896054, "uuid": "cdcf1080-a182-4dd8-b412-7ffce59754d5", "comment": "Malware payload (Heodo)", "value": "14795f32395167d3c47164505578d865554f8d9a3d44ec93c04ad75eeb4d043e864679965638b94fdd9cb6be65a0e1d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638896054, "uuid": "9b82951b-b126-45f5-aa21-00ca87e519ae", "value": "T17624D0B171808539FEBF66385D34D1845BAEBD90CB21ACEF7604019B9A685C08F73D7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638896054, "uuid": "d617384b-121e-4047-a2b8-a725340aaa14", "value": "35dc3f1eb8a03291fc0dc93396a967d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638896054, "uuid": "830f78b0-aa85-46a3-8a4d-1a210f9bf9f1", "value": "3072:MCDoXOpFVtI8/7gsEKr8x7tiUabb1mVDtdQhdYJBoo31kCsIN7Giz+w/gnViasLI:MGoX+VtZ/7vEKrWpwobNWo39sjC/Wss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638896054, "uuid": "a5d2ce89-702e-49a0-93d1-2589487717b4", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638896054, "uuid": "29c0e9e3-b5b4-454e-b116-f434342982c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638896054, "uuid": "fde5d692-19f1-4ec6-b743-e3919156519b", "value": "c6f3494064e025c03826c7c9a41affa1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d08e2a-57a8-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638914213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638914213, "uuid": "961bdca2-6277-48f9-bf24-9429436a86cb", "comment": "Malware payload", "value": "7d4937e27d0fd75dd6159ffe53ebb505", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ewdoor", "colour": "#62EFB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638914213, "uuid": "17796471-fa83-4295-8530-c7ea5af23162", "comment": "Malware payload", "value": "ec8f6839682d438423444f94028fa05fba2a8e1f1fed2e2317900b284dc1af73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ewdoor", "colour": "#62EFB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638914213, "uuid": "0b14a7c9-28b5-41a2-8c75-fbf4053554d3", "comment": "Malware payload", "value": "6c0d9ba5791597e89d0599a3f929eb84ea2a2e27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ewdoor", "colour": "#62EFB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638914213, "uuid": "9f9c69d3-1ddf-487a-b5c9-69e7024d1271", "comment": "Malware payload", "value": "c020e471bcee04f0286df6e3a241adbdeeb1c6fbee0b25265a8745e5351c9ce605a277e40551cd256df8659ba1bacb20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ewdoor", "colour": "#62EFB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638914213, "uuid": "93c4bfca-e8ed-4e3d-a18e-91f80f6d4344", "value": "T186940D3B9351AB0FD27C073046F839F4C76762951991AA41D2B9CA2CBBF605C0C9FE99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638914213, "uuid": "49f37505-2220-45eb-b574-334ce8e4b9a1", "value": "6144:xP3yOPRacuIC1Optzim47Eo5Njw6G8fq4EfAPlDgLzOxp6C4ai/X6s9qS/L/2PBn:B3y5PlaRFs/Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638914213, "uuid": "474fd6c8-9bd6-410d-bd9f-8f6fd4dac7eb", "value": 426416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638914213, "uuid": "c06ce0ad-2e9d-4a27-bbba-4095df05eb9e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638914213, "uuid": "881381ad-188b-43ab-9ddc-7dadb0ba70b7", "value": "ec8f6839682d438423444f94028fa05fba2a8e1f1fed2e2317900b284dc1af73.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62fe6e3-57a5-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638912977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912977, "uuid": "5917e079-5d02-4ddc-87b3-049bc15fdd4a", "comment": "Malware payload", "value": "7c53acee0a7410712bcddbd2ef13b689", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912977, "uuid": "6091c15b-f953-415f-aa1c-372d57960f4d", "comment": "Malware payload", "value": "edda95f68c0cdf9f4c13e4e35211b42666c014f2c0831210b59296071139f159", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912977, "uuid": "b4a877c8-7421-4cd0-a18f-fc0275bb2a22", "comment": "Malware payload", "value": "ec9a38bb47024bfcf4d8ac0e51bbeaa7745cd2d3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912977, "uuid": "1bf5e3a1-68fd-43da-964e-fd3a7aea5d71", "comment": "Malware payload", "value": "b1e5d22d0011908efba02f5b247e5a18d4e6267f0d7a0b404b530c4a4cc7afae2c5d079989cbd0df42c80a53caf89768", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912977, "uuid": "06473b52-8d70-4620-83cb-976512abac89", "value": "T1C3B53357AE946B78DEC7CEB8522260DB74B60C5150541FB2358EB91B2F3EE401E39E38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912977, "uuid": "0f30b372-91aa-40f1-958c-21cf20032280", "value": "49152:y0KabHRXPkFqday6AZGx9Zlav4CsieR9CpO7pF8ID5dIDcgJPDePYaY1JZGPF8:nK/YdNxGhls4CuR9UQpTmJqM1GPF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638912977, "uuid": "d6a25bc1-b1be-483c-a48a-702ac4150fea", "value": 2385000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638912977, "uuid": "7f4ec695-d6bf-4cec-bd94-48b4210c6395", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912977, "uuid": "56fb2cf6-2510-4b86-970b-b0e3176c6378", "value": "Hadise_Gizli_Cekim_Ifsa.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c945d4fc-5748-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638873066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873066, "uuid": "9f3aec7c-a430-4a58-bc4c-a01a5374ce63", "comment": "Malware payload (AgentTesla)", "value": "e524e8fd0c0fa0fae882f081f15d1a04", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873066, "uuid": "ed7ccabc-7d72-458b-b172-dc320fd1442c", "comment": "Malware payload (AgentTesla)", "value": "ee21472dcf053989bd774cd6517c83ea17247afa7c983ad9e7aa5311e84eebd6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873066, "uuid": "112b92cb-ed2b-484b-88fd-b6189fb3dd29", "comment": "Malware payload (AgentTesla)", "value": "3ea8e6e052c882af4b7e121c6b63e34bee27c1ad", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638873066, "uuid": "654bf163-898d-45fb-8be0-4511536aa22b", "comment": "Malware payload (AgentTesla)", "value": "2ec559cb8a730a72ed4b693c23e02bebfa11f715b1ab39f42b14e03530ecb2e052535b0721d5b0faddeefb7dbcd3e7ae", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873066, "uuid": "70be7a39-9aea-4bb1-b629-24f4c7492f60", "value": "T1F3D4237BEDA0E07571E38139B03395D026491BE1BE2399FC31A6F09E74E211AA43D72D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873066, "uuid": "3bef0ea3-b9a3-44a1-b5be-8d53414c4105", "value": "12288:dn52mZlSIzUhId9uXt8pYGNNjlvvG0+upRvjUFClhtaC/CwmQcy:fZl9YyHfBjlMufjNRL/Cwmzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638873066, "uuid": "0f9e2339-5361-4463-a03d-2a9704e42ec0", "value": 606950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638873066, "uuid": "b77f93ab-d65b-4fe2-bd28-ebdb8feb7cde", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638873066, "uuid": "80244135-a122-4f86-8672-905ac16d0056", "value": "Thorold Auto Payment.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7369bf16-5739-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638866480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866480, "uuid": "f3f0f026-d82a-490e-8283-5d6bbb22c065", "comment": "Malware payload (Formbook)", "value": "20b17bd6ed39cec50a85740cf92a73ee", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866480, "uuid": "bd3ff2a5-8141-4bf3-b424-a19b271d49c1", "comment": "Malware payload (Formbook)", "value": "ee995269e9d7964341656eb3595ca9834c766746868cb1338ac0ce0008dbe0da", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866480, "uuid": "0efb657e-fccd-4bfb-b721-6307c393b08d", "comment": "Malware payload (Formbook)", "value": "1ed38e4573c17a65a0860c5cbb0c63b3e4e0f1cd", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638866480, "uuid": "e384cdab-537e-49b2-a011-d6ab4e73ca59", "comment": "Malware payload (Formbook)", "value": "ed2c750f08afdf78e96adbbe6faf8929f3b904419dded3ef83929e1d9c8f9ad666b60f79d099926c7578dc2164947b0c", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866480, "uuid": "d71e9ffe-4aa7-4215-881a-e99b39ba6616", "value": "T1D67423BC7649B84E6FA2CE2F1271DC54CF7617995AC28767860C89C60AB3D8C153CBB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866480, "uuid": "a1ca66d8-a7a1-4f0a-9a37-619d4cc53e94", "value": "6144:47u+6YaJuKLg/wlk4IF5ipermElqPHu/Dt2znWlUG9ClvzVZkKnyBM22TKs3mcED:47cXJRLUF04yxu/BCnWDQhngxcKMmcED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638866480, "uuid": "93df895b-710b-4615-bdb6-caa90318637b", "value": 338175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638866480, "uuid": "9588d3f0-21e1-45e5-9061-1790fbedf876", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638866480, "uuid": "ad94a95f-893e-4a5f-9354-b55637644fff", "value": "Urgent Price request_pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb1e876-5798-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638907464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907464, "uuid": "456d8e94-1d87-4ead-847e-a032d5cda397", "comment": "Malware payload (AgentTesla)", "value": "48eeece89d9f549d52ee262dd2fef77f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907464, "uuid": "d1e9bca1-dadd-411c-b31d-573c381e7809", "comment": "Malware payload (AgentTesla)", "value": "eefccb24fccd254c92cc3c4caa2c464a949a07e8f328a58a6d26b15cb078f678", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907464, "uuid": "601c9372-6088-4f69-8738-2b07b1c9e1e1", "comment": "Malware payload (AgentTesla)", "value": "9bd8f879a42379821a9bd71ff477905eeb519eaa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907464, "uuid": "f5a6a2cc-2e05-45f7-9a65-6cef49325e6e", "comment": "Malware payload (AgentTesla)", "value": "24d85c31f549d91dbd1abf1eb6a9f21f554394f1fe1b158de5273f3571efcb9c3db46f0aea0c6ec059877a53e1111f1b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907464, "uuid": "d38c0e73-87c5-4689-8d2a-319eeac87fdc", "value": "T16C82B2ADC49706988F86ABB86B1B2F84158D361DF785A632363C933527D1C3B812787C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907464, "uuid": "30f69843-db14-42e7-82a8-25748615066c", "value": "384:1rWxf77SePGVyij3QXbAMrGRZjEhxe+M5/JMZEvbk4:1czGoiKTyZ4hxe+MRJnY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638907464, "uuid": "37466343-0276-41c4-8e26-3459d24b885a", "value": 19125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638907464, "uuid": "d662be92-cbd8-4299-ab43-f3232f0b6431", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907464, "uuid": "9c008c70-f835-4b41-b55f-89b758331236", "value": "Scan-0001234kl.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8c8c84-56f1-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638835571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835571, "uuid": "607d1349-084b-41b7-97c4-8093737a6bac", "comment": "Malware payload (Mirai)", "value": "65732e4eb16c09adfb218687aa749e66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835571, "uuid": "c80fbf2b-6768-40e4-baa4-0d143d706e33", "comment": "Malware payload (Mirai)", "value": "ef3605b4e3b908ff018c3779976fb3ff6df6e1823e72f6f6da426a5b0cc7327b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835571, "uuid": "17711545-dd05-449e-b0d8-8edb926820c4", "comment": "Malware payload (Mirai)", "value": "1912c6a5871f189d70ed9f17f8ab1b0d1604080f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835571, "uuid": "6d46a370-34c1-4ef4-a9cf-0e36364c906d", "comment": "Malware payload (Mirai)", "value": "7f6e547751ac72dbdab0a57b03d75d474a8f2e0bf4be93e08cc57d902696d01566a854df4481105db4429db942bae242", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835571, "uuid": "28060215-7b0c-40f7-afd2-f3be02b9fcab", "value": "T1C0E2E17F822161FAFAA791315EF403916E944FBF3057BD81A0A1D2AB8D81171F493BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835571, "uuid": "d708f8eb-f22b-4cc6-9195-612d6ba7b278", "value": "768:7Mx2fuvWPi8CgQOXXKJ86vg0FKT7uL5gyZHnsP0o7wqyvor8JgGlzDpUYsc:9fuuK8CgE1vgUKT7uL1xnup0VqYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638835571, "uuid": "82ad3f29-0962-4708-94c4-2566936f2ba1", "value": 33288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638835571, "uuid": "a68b69c5-6508-4720-ae03-e1d4be330699", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835571, "uuid": "ac0eed66-9d0e-4f29-b37a-d485ae221394", "value": "65732e4eb16c09adfb218687aa749e66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ca6982-5759-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638880119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880119, "uuid": "ad05a8c0-ce07-45e9-93e5-e2cd98745c0f", "comment": "Malware payload (AgentTesla)", "value": "609e3dec5ae82ef7a32e9d00dece3cf2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880119, "uuid": "ef89a5f5-45a5-47cd-8716-83312ff2694f", "comment": "Malware payload (AgentTesla)", "value": "ef61b7c0eebd6d64daf153faf53f1b85cbb346ea3bad2bf4ba91067362732cdc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880119, "uuid": "bb27ec75-d067-49fe-94bd-e5a815dcd86b", "comment": "Malware payload (AgentTesla)", "value": "069cb97177b502e9254a8ad9e8643148eca0d673", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880119, "uuid": "1a9d939b-4baa-4bff-ab08-f606095b3842", "comment": "Malware payload (AgentTesla)", "value": "a1b2c38dd70a31382971203d750f96c753dd463f38254dd15ccb8f0565bde0b5318fb59ee123f47603425ab6d45fe481", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880119, "uuid": "2cf332e5-9bd8-4f2c-9097-8afa6508165c", "value": "T11C03F601F55493B2D7E617F778EEF20CE2AA9D2C0217D9C6E4547E8C1A623812EF256C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880119, "uuid": "854d26dd-247b-404f-acd6-247096b88883", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880119, "uuid": "89407c65-5b07-460a-8143-a7064bea16ba", "value": "384:65U2KRWdfPAUpMLJLpfL+Uu7gHbsnzJLpSbpDVL0L0aVxptjTQf3vNesp+glh:dYdpaNBpHbqJLsbb40ipt/gwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638880119, "uuid": "1bf666e1-b611-4d26-97c4-93f208c41339", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638880119, "uuid": "6a3ecaf8-c9ab-4488-b11e-6b961c8b06c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880119, "uuid": "a50d046f-8953-44b0-a85e-624c941b453c", "value": "Fineco Banca Copia di pagamento_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d0e5c85-5767-11ec-96a4-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1638886145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638886145, "uuid": "3d9ed40a-61e3-481c-9cb5-cfc9c3a878ec", "comment": "Malware payload (RemcosRAT)", "value": "cfa60bb11f5eb66fc94426161364ac9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638886145, "uuid": "2fe0f164-fd95-4d5c-99ed-4827ad952aee", "comment": "Malware payload (RemcosRAT)", "value": "ef6a74a99e6f3945eda8bd082a0adbcc2df584aff03838ed1b5face974a4a6b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638886145, "uuid": "fa7e4f26-74fa-4bdb-bd83-cce6dfe95bbb", "comment": "Malware payload (RemcosRAT)", "value": "894e2376c16d58ff16a0ad72821c41c34ca44b90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638886145, "uuid": "b9d9f344-c532-4acb-9087-20c3397d2584", "comment": "Malware payload (RemcosRAT)", "value": "5329197e1f6fccf55bbf26da03dbcdc4911e8eaa9223c3b96fabc3c6caed36233eb479837041bb1fa550fdde08c6f489", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638886145, "uuid": "8fc98d12-42d4-4a78-b386-62d80949beb1", "value": "T174C4235A61E20867E0235332871CFA357BBEAFC981578B0F4752FD2B66BA3436554E03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638886145, "uuid": "62358217-ec5a-4841-a62f-7831c817a85a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638886145, "uuid": "452e6823-d0b2-472d-ac22-70a397cb265c", "value": "12288:hPW++y1jcPZp/BigzG5OLuh9ZtJ0HdBzYo6rgJ4LB4:dT+EcPZpZry59PJ09BzosJC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638886145, "uuid": "25a89b23-4fb9-4f1b-b996-b5ebfb00a676", "value": 555112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638886145, "uuid": "9bdbd997-2ba3-4617-bc85-55de677cdf39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638886145, "uuid": "2664d2d1-8b63-4adb-ba02-ddcd08e43c5b", "value": "P.O335647892.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1676867b-5778-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638893382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638893382, "uuid": "13bc4e07-a82c-427e-a5bc-95231d686243", "comment": "Malware payload (Heodo)", "value": "ee147584e2246a04dda55c3ed8f87fc5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638893382, "uuid": "ebd4cf3b-83c4-4875-ab22-93f22604e7f8", "comment": "Malware payload (Heodo)", "value": "ef96cbd6fd2a0b7dca8fa51159a70324f31a528d08df57f5d4a2f7781fee353b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638893382, "uuid": "0eb21fff-031a-4eb9-b7b6-997b28bdccb0", "comment": "Malware payload (Heodo)", "value": "80504e8b02d2d691dc0f6228f762646943cefd50", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638893382, "uuid": "a2ff05b5-79e9-4c61-afa6-24f42ab00501", "comment": "Malware payload (Heodo)", "value": "6fd1b6c5244183210d0034304659fd2950113991f7b0c188de32704d164a2fd9bf32989b4170930486e2a71445bce929", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638893382, "uuid": "f7c8780d-e74f-403e-ab41-4d9bbf00f980", "value": "T1D724D0B171808539FEBF66385D34D1845BAEBD90CB21ACEF7604019B9A685C08F73D7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638893382, "uuid": "6e8edd7b-03f7-47b5-be81-c412b8ea1e21", "value": "35dc3f1eb8a03291fc0dc93396a967d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638893382, "uuid": "4c91f1d1-33b6-4c64-944f-8dbbbbfd95c4", "value": "3072:MCDoXOpFVtI8/7gsEKr8x7tiUabb1mVDtZQhdYJBoo31kCsIN7Giz+w/gnViasLI:MGoX+VtZ/7vEKrWpwobxWo39sjC/Wss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638893382, "uuid": "d7495817-d298-40d6-be10-be7b1d2eae36", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638893382, "uuid": "67be453e-e9c7-442e-812f-b99cf8f92406", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638893382, "uuid": "a5464a4d-eadc-4b15-a410-08b0fcf7dce5", "value": "ee147584e2246a04dda55c3ed8f87fc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b00e1161-5769-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638887197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887197, "uuid": "7ca004eb-5517-4c79-a4c7-3be0cd97e585", "comment": "Malware payload (Mirai)", "value": "5e6c2a43159f92cf556c59c8912481d3", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887197, "uuid": "830528c9-112d-45a5-bd03-a1af713e0785", "comment": "Malware payload (Mirai)", "value": "eff35e573f3317c362a642cccb466f38bd20dd8e6b9a0df9f3041b719b5d67c9", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887197, "uuid": "93ba3e78-4c07-4805-bc8f-0c69f6a53b9b", "comment": "Malware payload (Mirai)", "value": "07d3c6450b7fe81567b2e24c8e752e8bc1ad343f", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887197, "uuid": "5dbb09f4-56e4-41f2-8853-f51ac9e01ebb", "comment": "Malware payload (Mirai)", "value": "77859f7084e1e904e7506d9e8921198caaf23f14de91f7b7a8a3fbd2659646fb65ea11daf1d29231a2957c3664f32a51", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887197, "uuid": "0ec62993-f6fa-4c1f-b9a3-2cd5defd3e8f", "value": "T1ED13F18E651FD738C01BA4F780165F12DEA5F98F916B4BE9165EB0DE281B6830036F4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887197, "uuid": "c1da04f9-cb1b-490c-838b-57e863294dcf", "value": "768:TaH9LGm6ekbsB6VoFUxXd7zB6fcwcPd8SX1KDH/1IyxFNx0+nBN09oQU:GdLFGsB6+FURVzBP8SX1KjNIyNpBNYot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638887197, "uuid": "87beee59-952c-443d-86cd-c0518b208dd4", "value": 43712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638887197, "uuid": "6cde14bc-289c-4440-97b1-e5dfaa570a6a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887197, "uuid": "f0a8b3f2-d97b-4fd8-802f-e29d74e49a62", "value": "5e6c2a43159f92cf556c59c8912481d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98329112-5750-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638876420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876420, "uuid": "4c559dcb-78bb-48d5-9571-47fd12147781", "comment": "Malware payload (AgentTesla)", "value": "9612802fa34ff3ac2a659c47f92389cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876420, "uuid": "fc5dca78-ac66-4bd6-8a14-c1d8eccd1f5b", "comment": "Malware payload (AgentTesla)", "value": "f01d7f6953fc5b48d3eedeb3b55c0816cfc5d487c4387a313e2aee1212cf4f6d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876420, "uuid": "6efcfa15-aec6-4f93-9746-d8dcef96edab", "comment": "Malware payload (AgentTesla)", "value": "1af1e2ab1489938bb3dbe7b1ce53b9fe66310f20", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876420, "uuid": "c6bbe634-f958-4408-bd7b-6768bf498d85", "comment": "Malware payload (AgentTesla)", "value": "348f44ca8197ae06fa6ae4392e8f1440b61bdfd8b00e3b1191bb2fdec374ac236adba767fb89c0884346a904e2b17ab0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876420, "uuid": "ab6e43c5-bdba-40f5-9ca4-867a07184557", "value": "T1193412883F02E5BAD94F8D3E7056A71E257AEE22145080D6F0D87391C9B7D31E296FE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876420, "uuid": "d461df4e-8503-4429-9bee-a98e5f05eed3", "value": "3072:PDNSNT2dcN3K30fxHzp6JiIqAkKP08kZD/o1eg0TVGHOcsw0HMpXpDUOxXPKq5Y0:pk2+KcxTg0tXK5GE1P0hLcksRpdc6nJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638876420, "uuid": "4f29ef87-595b-438c-b1d9-bdaf871c5d24", "value": 234520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638876420, "uuid": "a72d057d-db06-4283-84b0-46818f4f18c6", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876420, "uuid": "845197d8-cdd6-4d96-8494-4f7b73e9ca31", "value": "0000002345.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "890b7c69-56f1-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638835592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835592, "uuid": "a5319acf-bc88-46fd-8a7b-0ea7aba5e36b", "comment": "Malware payload (Heodo)", "value": "6386cbb5ab85dcae8c018a819a506aac", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835592, "uuid": "22ccd5f7-8317-4693-aed6-8d33eed4b856", "comment": "Malware payload (Heodo)", "value": "f028117976f4eec91f49f4e576b86ef5fec9977c5be5e6f08dff1b706e03881a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835592, "uuid": "59f41d81-1de3-4224-a5ce-42010ee456b2", "comment": "Malware payload (Heodo)", "value": "64ae412f6aeec220eb510fd9c221a2166930f4ea", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638835592, "uuid": "eaa42e85-4c3f-4eec-92d0-2b9eedc7cf56", "comment": "Malware payload (Heodo)", "value": "84fae0adad01f64e93a10b2fcd68637e3925f81514bfa60f4e692399c084716bfa8127aa877d6d51fb2b81b4f8b10d44", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835592, "uuid": "2fbadbcb-c021-4619-8824-a15388433b38", "value": "T1CEF48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835592, "uuid": "496125dc-c883-45d5-81a2-7045ae5e1cc7", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835592, "uuid": "b0b685fb-1186-4e44-93dd-f23ebfaac7e9", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/Z:JapiKiBEmj4GbOX399Md9J/0Tb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638835592, "uuid": "93c306fd-c04f-4323-8cbb-f72119ed7e2e", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638835592, "uuid": "00ca3b2c-acb0-4b49-ad2e-6649745bdc3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638835592, "uuid": "4b63aa51-35b6-4f31-b422-d27778e17bea", "value": "emotet_exe_e5_f028117976f4eec91f49f4e576b86ef5fec9977c5be5e6f08dff1b706e03881a_2021-12-07__000627.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc11ca6-5751-11ec-96a4-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1638876701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876701, "uuid": "21e626a2-46af-436f-95d4-77f456c20f64", "comment": "Malware payload (Loki)", "value": "daa0655651ec1c5e9ee0edafdfda77e4", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876701, "uuid": "4b3160f2-7fa6-4b1e-9675-f7cd3c581c0f", "comment": "Malware payload (Loki)", "value": "f09b7be17b300230181650fd4ca21dea1c6949c794f8ffb132de526f70f8d58d", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876701, "uuid": "612c45e3-d03a-40fa-bcf8-352b15211205", "comment": "Malware payload (Loki)", "value": "50a80e89561062e455360fe9370bef41950f037a", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638876701, "uuid": "24c6eb9c-7fbb-4b94-81f8-f9184bef94ee", "comment": "Malware payload (Loki)", "value": "df0bd2b067ff7cf4ae6361019c5f02342805cc481a9585036f418fc95f68bf8bd14b07f423b25855329594e623efd25d", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876701, "uuid": "56e41f69-debd-487e-9a77-4454c8d4b693", "value": "T1E23412A635E06576CE60847D0434711499FCFEF5E838A0BA3DA6302F2A3B510FD3A1B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876701, "uuid": "9a3a7d33-0b6d-420a-abc9-65152eda87db", "value": "6144:7Z3EyXGrGtnusTyaDCc0as/bRF8H1pjD3Cr0xkc7slK1MiBn:xEBrQnKZUVJo+NgKC+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638876701, "uuid": "2cdc604c-d9f5-4b82-bd67-1ad3c2857e71", "value": 234360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638876701, "uuid": "23075990-3691-4b33-b1ca-e32fe7a7290a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638876701, "uuid": "f7a5b442-a776-46a7-8f51-ebd165be9e22", "value": "Bill Of Lading.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d599837-572f-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638862014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638862014, "uuid": "faac0840-6399-400d-addf-5c8856158727", "comment": "Malware payload (Heodo)", "value": "5c3c3653cda4cbb429642ce695402f61", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638862014, "uuid": "1becceaf-7b12-40a8-b9be-0e349777e114", "comment": "Malware payload (Heodo)", "value": "f15d69f9c119d545d545ecb521cab0d882b0555bce71d22cd7628d6a51e504b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638862014, "uuid": "cbb727a2-b8bd-4869-8591-3a73cd21812f", "comment": "Malware payload (Heodo)", "value": "7d10cbc62d438c1bff936570f5cbd8c172e32d6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638862014, "uuid": "fbf654a9-806a-4460-b15a-8503f01a4ffe", "comment": "Malware payload (Heodo)", "value": "3b329a1d83ee6d014e83e75a41d96d0b91eaa6a09d21ddef4a9ec4fcae9bebbbd064300b07bd0af9b15331104bfcd84d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638862014, "uuid": "506e2958-9f8e-4f8e-b4f6-397ca76984b1", "value": "T1A3F48D40F741E036E9FB00F6C6F74A6A5A7C772053A29ACF16C81AE59B255D03D32A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638862014, "uuid": "d5882967-8746-444e-a26d-835928d5e3f5", "value": "10d92d46090e20fb2bc6f17a1e14c249", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638862014, "uuid": "60c81277-b1b7-4a0c-8b17-b6c2d8bb4484", "value": "12288:JKUuppiKVoByYUTsRuEhj4GbOX39UfNWuoDtS+7g4jQj9J/tWTR/F:JapiKiBEmj4GbOX399Md9J/0Tz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638862014, "uuid": "25b401a5-d83e-44f0-b8e6-bbc50edc31ab", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638862014, "uuid": "8c5eb626-3de2-4560-a92f-7bd71e441dc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638862014, "uuid": "3d745911-47da-4ced-a3ba-c96109e91f3a", "value": "5c3c3653cda4cbb429642ce695402f61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab0c374-574e-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638875324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638875324, "uuid": "eed461e0-2886-4e42-ba92-2c1ba5af33ef", "comment": "Malware payload", "value": "5ee7f09c47e19f521429913f17dc25f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638875324, "uuid": "3fb87eab-4f50-4267-a1f8-3108f80fa3a3", "comment": "Malware payload", "value": "f224eb6d7d25fed68f1053c7f38fbf09e416fc55230d04a1591e97aa2144c092", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638875324, "uuid": "042a2d2d-8542-454e-9ee6-07872e02ac16", "comment": "Malware payload", "value": "b959997807659f8394eb0bbe3342956311d61990", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638875324, "uuid": "79740b45-acf7-49aa-ab44-9bee39376213", "comment": "Malware payload", "value": "e91aa56d1d78b509b659b0779b36dd567fee9299ad5c44a07e3dffc01ff16bd2687259be3e82cd0ab6ca25dd5427c7d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638875324, "uuid": "96d4ed63-0ba6-46f9-a826-8678694fcd19", "value": "T10DC52385DD981377C1772834206358CCD9B44CF22A38CCBA93F467CE78B56A9B679392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638875324, "uuid": "900d1c7d-e883-4692-8a9d-43ce68270f8d", "value": "0913f12996bcd23942406fb9e8fee350", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638875324, "uuid": "b4e54432-efdf-493d-8890-08d36c0ddc2d", "value": "49152:V78+9qXFirnJlSS6scgAsy0IrqR7QRa10ryYrx6xgJW+GUy10f8rx3Su0H+fVLFv:h8+MX8rH56Ts4rqGRa138AyJW+ny10f4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638875324, "uuid": "7c39f173-ea96-4dc8-b677-3e169ddb11a5", "value": 2602282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638875324, "uuid": "7a71e5d5-f2db-44ec-a29d-43797a5dcde3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638875324, "uuid": "fb902e0a-d47a-4670-bc27-e5ec2b81dc3b", "value": "5ee7f09c47e19f521429913f17dc25f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a2c06b9-5778-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638893442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638893442, "uuid": "148cb99e-6c59-4e8f-83cd-742252be5155", "comment": "Malware payload (RedLineStealer)", "value": "9864c0f6cabddf66703a8795d3315c42", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638893442, "uuid": "e26f65c0-c3a5-42f5-881f-92230dd9d65b", "comment": "Malware payload (RedLineStealer)", "value": "f22e83aabc600ae7e4faa665f68e4adfc83887c3d5667a4a5dc12462eb248f4d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638893442, "uuid": "39915c02-ff31-4139-a5ca-4544ba6eb525", "comment": "Malware payload (RedLineStealer)", "value": "e6e619f76ac503d0c7fa2ad5b21a6df9a2d0166c", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638893442, "uuid": "fdbb41c8-2735-4165-a836-ce15f93af182", "comment": "Malware payload (RedLineStealer)", "value": "30bb9b14e13d0465a1dfa9c8014b42a2a47c2c49d1176c78791311b3801d103d9b4e967346b8f38a8e3068788679bd38", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638893442, "uuid": "720e9dba-3f9c-4305-bb99-67aa6f9a5132", "value": "T1543733023273AFA9D85D64BD5709235AC6A94DB130B8F4E0821D6AFE1FEDCB6C135E05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638893442, "uuid": "ae16a0e0-6576-49ae-8142-c4c79253257e", "value": "393216:cVQ8yz/Te8fqHnPx73nesM5SFnOapkJUoisPAPyBQMcmeM9o2w3HghPXjD:ZfqHR3rMIYLxAP0cl3AJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638893442, "uuid": "bb78620e-201c-4fef-93cf-2216826c9ce2", "value": 22674781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638893442, "uuid": "c93e4226-68cc-4be2-966f-4d6cf8abdc25", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638893442, "uuid": "0e60edf0-ed0e-40ea-943f-3aff9edbef9d", "value": "FaucetPay[1].zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "081596d7-5720-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638855562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638855562, "uuid": "1b46da14-611a-4690-b7a3-8670c315f33c", "comment": "Malware payload", "value": "5ef055296a53ed6d37102a22ad948bc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638855562, "uuid": "c5709ded-922b-48cc-88f5-a167a48eb30e", "comment": "Malware payload", "value": "f2e4b0f9d817f79a6066879998e96097f5f845911580b31898bd950800b1f9b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638855562, "uuid": "d0f956e0-724f-4b19-8463-150938d0adf7", "comment": "Malware payload", "value": "659560e0661a44e767756825974cc533d32c807d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638855562, "uuid": "12f67758-87fc-4538-af9d-8022d447af66", "comment": "Malware payload", "value": "1e67bca1195018c3d87a2e68d3d6ae7d104281514e9e541c41491e6501de0748296f30d0693df470e1e550a620bddbfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638855562, "uuid": "737de85c-69c3-43b7-9e55-7916f1f12bae", "value": "T1227623BD6154375CC41AC8308533ED04F3B5152E8EF9E5BAB3CBBB806F6B4219A46B49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638855562, "uuid": "45c20afa-f16e-46b4-8909-f425901f2088", "value": "6c120206d1217ca5baa24a89b5456ef7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638855562, "uuid": "3b8719e5-a959-4f95-b46f-2fe95e24678d", "value": "98304:dRK3bfMF+umW28qhPvOWIqYx2pzKL4BTk+bDDIXgaLdWpMUg7HZZuBUh7MeQni5L:jiU8eSHhkx2BG03I5hTxzCBugPkJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638855562, "uuid": "9d8eda65-7645-4589-b032-27e9dc99ba96", "value": 7167488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638855562, "uuid": "0fb4baaa-93f1-419a-97d0-ed47dc2f702f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638855562, "uuid": "b8de2b86-85e2-4d2a-a393-ae9fc93bc7b8", "value": "5ef055296a53ed6d37102a22ad948bc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a00c24e5-575c-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638881587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881587, "uuid": "ef7e4169-9232-41c0-9d4b-5d6c6f35b942", "comment": "Malware payload", "value": "898488164236713ae625ed5821f4ed03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881587, "uuid": "7e902cd4-8519-46ae-90d3-580e3ee4f97d", "comment": "Malware payload", "value": "f3a19ad9cfcdff50953eaa07b97b5462c8667fad9e578dd6911b973e81a1e763", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881587, "uuid": "5c014077-0ef5-46b5-9d1c-07522724dceb", "comment": "Malware payload", "value": "eccb748c717101a1becd173e32f62ef39de1cd9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881587, "uuid": "dffd4eab-0e12-48ad-a40a-6ca8b2020564", "comment": "Malware payload", "value": "dfccab238732ee84438801c5189d4fe61c828335d1bfde4a1a0ffb61b694a0be56663a94208f02656172ae326ea87e47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881587, "uuid": "de7619f2-0789-41e1-8689-65f94d43cba7", "value": "T1E0148E2136C0C073D1A634B6C229CBB55EFB787611265ECF9BD509B51F34BA2EA2530E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881587, "uuid": "7445909a-15c3-48c6-8495-8be3bd46bbf2", "value": "3072:chxpvRUiAAvrQ0EgirJieDKgrWmx+NjH0Kv24c3ca1GHHKz:2vRUiDrqFh/rWmxMH0Ko3GHHKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881587, "uuid": "fd458c68-844e-4eab-8d97-658ff4497769", "value": 194713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881587, "uuid": "f6242226-c09e-421b-822e-b206c3a8de25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881587, "uuid": "82a22cc6-d2d1-4f8f-93c9-c7b32af0d1df", "value": "898488164236713ae625ed5821f4ed03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231807d7-5723-11ec-96a4-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1638856896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856896, "uuid": "b418bc01-6cfc-4360-b498-a54171ba5eff", "comment": "Malware payload (Heodo)", "value": "317d72ad792f1f65e644c50a2d167452", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856896, "uuid": "b2e41eaa-95d4-4808-a119-4a345b2cca1b", "comment": "Malware payload (Heodo)", "value": "f3ac019eab479e67f89b68a86089f9a532b7183be3feea6639d815a8dbfbe4da", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856896, "uuid": "a1955858-07b7-47c3-82f7-5bdeef8d39d8", "comment": "Malware payload (Heodo)", "value": "e0d37d6456626a0d4d10443202e3b0196f19fd03", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638856896, "uuid": "572e7066-196f-4738-b946-97cc95404470", "comment": "Malware payload (Heodo)", "value": "25d8c2afdd397d88fd3536eed49d172b7152ee496879c5256f1facd575ecf92a93e95c591649018bda4ffd2c238d20f2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856896, "uuid": "df36b193-f010-4a2a-83db-ec2546813bd3", "value": "T17C844A40E701B12AEAEB00FACABB49AD9568B71413D76DCF15C86EE5D7284D03D3261F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856896, "uuid": "ea45e40f-4194-43a3-ab4e-67e6f1055849", "value": "6144:J2BMQOuPfzZLawDZj1MKVeRByYUTSRRuEhwdSyGVWHmw2MnvXkWc9w4:JKUuppiKVoByYUTsRuEhj4GbOXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638856896, "uuid": "afb67172-fe53-4a73-a6e6-974b8cc95edf", "value": 396225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638856896, "uuid": "d0fa924d-b076-494a-b311-e59b333fa776", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638856896, "uuid": "d88f2f3e-b1b9-4ac7-817a-1eaa5bf527f9", "value": "emotet_exe_e5_f3ac019eab479e67f89b68a86089f9a532b7183be3feea6639d815a8dbfbe4da_2021-12-07__060132.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "146a0d35-5759-11ec-96a4-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1638880064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880064, "uuid": "f2c07038-a32c-4549-b5a0-87932e105f6d", "comment": "Malware payload (GuLoader)", "value": "3f76a0b1d98b75966491adf56c4da7ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880064, "uuid": "a4fd0afa-697d-45bd-924f-1c85f7b793ca", "comment": "Malware payload (GuLoader)", "value": "f3c00377230cc4fb97c93e4030c391e3910c2fde3b390cdbd0ba10bbd4922cc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880064, "uuid": "d2414be4-a19d-4d12-a0df-ec0dbc952a70", "comment": "Malware payload (GuLoader)", "value": "c292cf86dbf0b79604207c905689cf3e0d46ca84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638880064, "uuid": "13e4e3a4-4ca0-43e9-8859-0728196d2c42", "comment": "Malware payload (GuLoader)", "value": "bac0eb9731ab788b4a5ac5ba77af1f1748528bb15cf9b44bf0e9872c02110524ed0698400c70ebabe8a0d8a2ce893a98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880064, "uuid": "2d35627a-e24d-4e08-9d53-405ea75b7419", "value": "T1ABF328ABF620F753F109C1F933016A78A0C42430DA55A467E5DFCBDA25B26D2BD14B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880064, "uuid": "cef41350-04d1-4c11-aef7-fd451ce865a7", "value": "041bed4e18fb2bf24204621a1040d963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880064, "uuid": "a81a485e-f3dd-40bd-b93b-c4853a5ca70c", "value": "1536:QVtZp8BTf//OH9iCXs6+UmFeQNrEloi1chdZaEupoOlFR9hqiLls7zB024oud++p:8ST3/+rEv6Z2Lupo8u60GHv4e71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638880064, "uuid": "56483d2e-a3a7-4f14-9565-7f4a0b146ec1", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638880064, "uuid": "2d8e8083-4b78-4857-af16-223a8b955493", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638880064, "uuid": "650fd831-c8b8-4a21-b615-8195ff4141dc", "value": "20211207-BS-Ert. Born 449 Kl\u00f6ckner (uZ 12-270).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462d30ad-578a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1638901193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901193, "uuid": "fb4a8ad4-c398-4a5f-ab5a-5884d9b345a3", "comment": "Malware payload (Gafgyt)", "value": "4969eb3f8731b232c3bc8d9a21981cdd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901193, "uuid": "5a8381c8-9e65-4dac-b3c9-1bfb828fbe6e", "comment": "Malware payload (Gafgyt)", "value": "f3d159802ee3b8c6a5b3252c37978337b70237aefb73c5e0789d7e88080947f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901193, "uuid": "8b10cfd8-7bc9-4c6f-ae42-1e70fb64cecb", "comment": "Malware payload (Gafgyt)", "value": "09449f9614549dd581b67c1a96ca0ab02e87c9f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638901193, "uuid": "ded40d22-fef2-4660-a748-0d937c7f5c3e", "comment": "Malware payload (Gafgyt)", "value": "75758d7761abe673bea14f4cc034929ae564be8b6b3b0277be2852973b22a5f7577d66230eb51f19eb7d5145ee4daaa6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901193, "uuid": "5d6c8766-150a-4d56-b70a-da3ae8d32f87", "value": "T15373BFB1D0687CA4C25C0138B9F9C93A2713F404A6635EF45E568BAA640BDECF51E3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901193, "uuid": "cd39e126-4c1b-4478-ab33-7244531de959", "value": "1536:z/BmB4rCblwt3iGVUkYrj6XVIfoXwFTAIwSeGCBfe:zZmqGblEiGVar+qfNTAIwSeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638901193, "uuid": "75d86469-aa38-420f-a03d-8c3fcba1646d", "value": 76804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638901193, "uuid": "ef908495-3e37-40a9-a009-2d946729f376", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638901193, "uuid": "ee465472-2b98-4612-a913-589b58df070c", "value": "4969eb3f8731b232c3bc8d9a21981cdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf0b94b-577a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638894438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638894438, "uuid": "81cf8e8f-07da-4956-9c9a-2e41ca2613ec", "comment": "Malware payload (Formbook)", "value": "1e7e22d96504d827cce75b41ec958d22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638894438, "uuid": "8d8f5d34-d8d3-4510-b582-91e201da9d29", "comment": "Malware payload (Formbook)", "value": "f3df0a22e5b8019a86a79a232bc3578929329ad0506378b8ccea37d99b1a6b25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638894438, "uuid": "cde6b0e0-9330-4f67-a470-6241f346fb58", "comment": "Malware payload (Formbook)", "value": "d616aae476695482087c39d66269336720fdcf81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638894438, "uuid": "3ef94588-9efc-4f46-b6d3-2e522075a226", "comment": "Malware payload (Formbook)", "value": "430b3846697b867849412ce0d6c096ad46b2e741ca617aa622e0e90817ccd9145e760de8035ee3dd248715f7c7b7d64f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638894438, "uuid": "150e3e8c-d3d8-4881-b729-a026c85f04b3", "value": "T15435230277F5C772D97617782A59206023B1B15A3983E36D2EE06CEF39A7F818911F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638894438, "uuid": "c6c512b1-bf56-4f8c-ba4b-e3659f9b25a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638894438, "uuid": "c76b088a-2003-438f-bae9-d45f61c72422", "value": "24576:+rC72fOT4jsexmFdKxSDGDgFXOX5mJQtqyfR4tkx4ViEv/N8dlUzYehN:J7qc44dFjXOOQtqyf6tnVBN8dlUzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638894438, "uuid": "0d5365f3-faec-4492-968c-3e06ef0c87f7", "value": 1059328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638894438, "uuid": "e1ab3593-0621-4018-8946-6af19d799e13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638894438, "uuid": "9a9dbe5f-7213-420d-9c3f-709a3ec30c61", "value": "payment slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a38743c1-5734-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638864413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864413, "uuid": "215590c5-9a99-456f-b6f7-0acbbb46a11f", "comment": "Malware payload (RedLineStealer)", "value": "8115c18e4a3c344f0271bcb940c06735", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864413, "uuid": "8f42b969-7eed-4f12-9b4f-4233bef53e19", "comment": "Malware payload (RedLineStealer)", "value": "f42def3584cbdd93edb8c9b22a6334826f90599deff3ae35375fd8606a64fb9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864413, "uuid": "dcaf454b-807e-48b0-b979-4e279a126fb4", "comment": "Malware payload (RedLineStealer)", "value": "8f06bf3889b78eeaeb7c88de5a3598bb559292e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638864413, "uuid": "acd40457-f36e-4efc-8d31-58898e77d8b6", "comment": "Malware payload (RedLineStealer)", "value": "a2879d09c582b1e6edc43e0d458e2dfc69dfe3612fd74ac33d1e68c990040f04128a08f9f1efe5e87c300b258afd93f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864413, "uuid": "f514a1dd-d90c-435f-9ba4-f0f6cf17cfe3", "value": "T168159D1273D2D036FFAB92739F5AF20696BD69250123852F13981DB9BD701B1233E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864413, "uuid": "5254d9e9-5ea5-4ca6-8529-fcfb2ade4500", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864413, "uuid": "3875f724-ff21-40ea-81c8-e186337f2df3", "value": "24576:rAHnh+eWsN3skA4RV1Hom2KXMmHa/1IBs5C:Gh+ZkldoPK8YaNI4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638864413, "uuid": "310d97a8-b8de-430c-abd0-386d989b09d3", "value": 890336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638864413, "uuid": "6000c48b-1562-4696-902d-eddd2fa93421", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638864413, "uuid": "f6de4447-1455-4ff9-b4cb-8a9d3f8374ee", "value": "8115c18e4a3c344f0271bcb940c06735.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f63da8-577e-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638896032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638896032, "uuid": "7cec678d-60be-4cb7-a792-f0209c476482", "comment": "Malware payload (RedLineStealer)", "value": "4113069fcaa6e94a69120366ec630c9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638896032, "uuid": "4b7fad85-393f-4dc7-a656-0c4c4fd56129", "comment": "Malware payload (RedLineStealer)", "value": "f4580de8ed4b87729112d8e7779926905ae7b859dbe4ec029576103ff92e1af9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638896032, "uuid": "7ce2ace5-cbbe-43b2-9653-feecd577431a", "comment": "Malware payload (RedLineStealer)", "value": "00a50e98556711cd1df2fb42c03ab1123ee3ef4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638896032, "uuid": "e5a6fa6f-c8bb-4a71-b762-027218d0ac07", "comment": "Malware payload (RedLineStealer)", "value": "c16497df52f359f4dc9b7ba665ee76e0a64a16d78d716ef580ade32806a5fdff1cfe8d53dce7f36653f3eeb85880623e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638896032, "uuid": "a2d75923-0c45-4414-9e49-d251a768dbe3", "value": "T123B4F62839FA5019F2B3EFB59AE875A6DA6FF7633707A11E105103864B13A80DDC123D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638896032, "uuid": "57905049-4a45-4006-b7d4-2312dceafce0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638896032, "uuid": "c4cf82f4-7008-4a56-88cd-533fbdf4427c", "value": "12288:aYYBJLsXdwRhXuQCsA8nPYvCASvLqHYFAtoFt:jYBJLKgenTYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638896032, "uuid": "e03a4b14-c783-424c-9f11-5c79e5ea5745", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638896032, "uuid": "402dbf39-5866-4589-bb16-c28cf303c416", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638896032, "uuid": "bc988eb7-411f-4d9f-bb22-11a4999dc044", "value": "4113069fcaa6e94a69120366ec630c9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a2bf440-575e-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638882436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882436, "uuid": "786afc4f-a56a-400b-9397-3a260388bb97", "comment": "Malware payload (Formbook)", "value": "56d104133e30aa45f49b8cffd8a43ce4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882436, "uuid": "3fab5919-82de-44a8-8fe0-44189856ed2a", "comment": "Malware payload (Formbook)", "value": "f4d61495086555091ce72a0fdaf2406a0c82b4401ce366eb50ec4d5b5041a795", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882436, "uuid": "c9410005-b1e6-4f07-bdfe-ae76d626d8eb", "comment": "Malware payload (Formbook)", "value": "b77df1d3d536f9f86f6f13a8b6cd4c4ad4911cd5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882436, "uuid": "603a1f9c-1c81-49d5-81f3-0854cdb43c15", "comment": "Malware payload (Formbook)", "value": "5aeaf28036318c96de5b8fa3083be8dc1b042f2f30a32953602f282e28385369b162b450b6ac28227a2ee4bb33a7cbc8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882436, "uuid": "ae3e5000-f62e-4113-97a0-22410f27c6f7", "value": "T1EA2523A013D14275C4EE17F974B4A03187F14E9FB517CB6A2EC07AEE38A3B499511A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882436, "uuid": "2913d753-7bac-4fee-9568-5ea18db82c76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882436, "uuid": "8928a517-67f4-41b5-8b9d-fd643e17825c", "value": "24576:ILFeZsOfV4Hkh4jIqlG0c2PJ4RsrLVR/TwjndRFuL6:ILFerflhAFusr7/TwLdRwL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638882436, "uuid": "c1a7958c-a46f-434c-b4b6-94766f84904d", "value": 1024512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638882436, "uuid": "aa11f3c9-7914-473a-981d-b59970ac3de5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882436, "uuid": "7d83a478-6ae9-4e66-b723-3cd237c880ec", "value": "56d104133e30aa45f49b8cffd8a43ce4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5998262b-575b-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638881039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881039, "uuid": "69345715-600b-4ff6-b067-dd0bd290fb96", "comment": "Malware payload (Formbook)", "value": "6b360fb5cc2a1eb64043e8b0399d1e0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881039, "uuid": "e05c4e41-17b3-476e-a445-8c2cdf86c248", "comment": "Malware payload (Formbook)", "value": "f5f1c939d0716dccf4bc706e78195b3207dd19665a6eb7fb152bd35a55ad3345", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881039, "uuid": "a482073b-799e-49ca-9658-e0135b6ed170", "comment": "Malware payload (Formbook)", "value": "84292bb6fb47b34028eda3857958b02107273293", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881039, "uuid": "51c28bfb-272a-4d01-9fed-b838d4ce5d00", "comment": "Malware payload (Formbook)", "value": "96cfc16850b6e97850c27f874719576897b7b9e8e1b195325315b1fee2889175edefa187fbc04f75ddd12bd3d378d441", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881039, "uuid": "5ad97505-5b5b-4877-bfd8-bfdcc341b22a", "value": "T1CE74222ABDC494E3E5D185B06F7BF3FAD7BAF98500E1684B1F140EA60C512834FAD466", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881039, "uuid": "1586847c-4712-4fe5-bd13-9602ffe369f7", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881039, "uuid": "01c6275c-e3eb-419c-ab3d-4efefe2cd195", "value": "6144:rGi7+SaMqRfIaoIcHPtMbavFD36Q6KuacSPEZWaxppwymezaqoqEZbcxPkng:X+7AXIcHVMWvFDj63acSchX8bcGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881039, "uuid": "e8997323-c008-40a2-b3ef-cf9240307da7", "value": 368248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881039, "uuid": "fe4efc27-1ca4-4d9f-bc1f-ff407c72da02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881039, "uuid": "150c10a5-600f-4c9d-ba13-a999ae053758", "value": "6b360fb5cc2a1eb64043e8b0399d1e0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bade6c2-57b9-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638921523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921523, "uuid": "3a2d0afe-3b2f-4cf3-a8b5-4ee5460c94ef", "comment": "Malware payload (Mirai)", "value": "51448b69d96fa70125c11793365fb2cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921523, "uuid": "e1d85c23-6ff3-48cc-a372-b86b72e8371d", "comment": "Malware payload (Mirai)", "value": "f6377810e04b9f430ec1a9cdd3f37d0496c385b3ecffc22a6a0c26dd63e5b3e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921523, "uuid": "61ad674c-baec-4083-94c4-4639f5ea1a82", "comment": "Malware payload (Mirai)", "value": "e537bf21b10a12ca8c1f20c35e892d1f1b8a5d2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638921523, "uuid": "528684cf-9859-4670-8156-7f1317b80a18", "comment": "Malware payload (Mirai)", "value": "6fe90a6c9ba62f047f1ff4644447f97c2b4369f453387f5f80539556afa9992aaaeef9d357fc0773a701668f50c02c60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921523, "uuid": "562ae93a-1c27-4737-b2d9-c7d4cd0490d2", "value": "T114832924A9383F22C0E4A47E52F78316F5E6260E14B4D65D7DB60F8FFB10680A9173B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921523, "uuid": "ba362668-f90d-40b9-897f-0d91a379dbcc", "value": "1536:fFq1axGvRJ7dcJYNAaDO2dE9CDtcndJliuVMTAvTUiyH5oMlwmFRY:NgdcNzCDtcViuVMcvTDyZomrY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638921523, "uuid": "46d4c5c2-a8f5-45d5-8dcb-45f05c01a302", "value": 82944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638921523, "uuid": "5d84e1e1-d026-4545-9576-792749c69185", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638921523, "uuid": "bfc45fdb-8893-430c-a5f3-4b36e0d7c31c", "value": "51448b69d96fa70125c11793365fb2cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db886fbd-57b7-11ec-96a4-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1638920771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638920771, "uuid": "44344d2f-b175-426c-a5e6-e316641bea48", "comment": "Malware payload (RaccoonStealer)", "value": "a4822c960055c8c34fcc130bae6f0d86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638920771, "uuid": "51cc61f6-e7be-4a83-af2c-4cc6b4c0d694", "comment": "Malware payload (RaccoonStealer)", "value": "f6401919fd20e698ec964ca0df4eee18c1f13852eef32a9246fe4605cff79969", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638920771, "uuid": "19f0006f-0f20-4d5f-84e9-34491fd98d6e", "comment": "Malware payload (RaccoonStealer)", "value": "bd5f62284b8c1c905a72b3c7f66240a4704e1bfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638920771, "uuid": "28e8c0f0-43c5-4aed-904c-19184e8cd924", "comment": "Malware payload (RaccoonStealer)", "value": "a7568d996329b2127a4e85c46641f867c841039ddd2ab97a899ff4b5150a79e5523cbb2873b8987a42d7474df3d81ea5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638920771, "uuid": "b75914a2-2934-4a82-95c9-1d2d3277546f", "value": "T133648E1066A0D035F5B712F85AB99378A93E7EA16B3490CF13D427EA5B746E0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638920771, "uuid": "e13f02fd-6444-4bcb-b3d8-6787a4cf9c41", "value": "4eb02e1fe9496df33596532c6e671ce9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638920771, "uuid": "6aed1373-f219-42fe-b401-1cd6f949b680", "value": "3072:9lLLm0Iy4e+AJgCUBrJcgHbm2mrYARcA+l5Bz7ruFrYEKL0gHU4uf3kl9buZXQ73:DQrJ3sp4bTSrY3g1B4ZuBu2qheBku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638920771, "uuid": "c5bb809b-4bdc-4f30-afdb-c7761a30dee2", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638920771, "uuid": "e26667d3-c10e-48e5-8709-572066a92978", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638920771, "uuid": "94a5730e-6327-43f2-8ee5-f821c0dfea3e", "value": "a4822c960055c8c34fcc130bae6f0d86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd565a4f-5798-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638907460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907460, "uuid": "b6548ae7-7757-494c-a92d-42ed2d788515", "comment": "Malware payload (Formbook)", "value": "492215cbf3aa75e3b4fe1a21e1ec3551", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907460, "uuid": "4a7359ff-7ee8-4a91-89ce-cf930aa16b2a", "comment": "Malware payload (Formbook)", "value": "f68e0d0d70d45d687e8f161727cd66401d1fa7ab2f64a629141c49e9e79c501c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907460, "uuid": "6a13c491-c690-4de3-95ca-ef59a9784783", "comment": "Malware payload (Formbook)", "value": "bf2432d78ba60b8237d905d4907f03bea99e4364", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638907460, "uuid": "cffaea72-beba-4a4a-98f6-323fd913d755", "comment": "Malware payload (Formbook)", "value": "5133cc110be3f40ab61d7ece173618aaa13e82af8493d044602f2dc19807f3b55210e0f9599048915ecfe241bf5c61a4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907460, "uuid": "0f10a7f6-6681-45e7-a705-cf243d75da87", "value": "T1DF720FACC4970698CF84ABB8672BAF41054C762DFB88A632757CA77527D1D7B801393C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907460, "uuid": "1f69d1a1-d734-4274-9b4b-3e04f0bee234", "value": "384:HPbdV05nCxFGqfIyZSZQtO0ODcVwjjcrXT:HDdV0RCeGZSet3dj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638907460, "uuid": "bfdd8203-1525-444b-b8e7-59042bd914c3", "value": 16754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638907460, "uuid": "f32a516b-82b1-4d0c-98e8-63b4b1621c75", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638907460, "uuid": "32fb0199-fa4e-4842-a352-985575af41e0", "value": "897258.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba630032-5769-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638887215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887215, "uuid": "de517ad7-e347-4d4d-8612-d568ddd5c602", "comment": "Malware payload (Mirai)", "value": "aa0113c8bad240cea24e20d7ac2172c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887215, "uuid": "57f44e93-f727-4102-8152-6d1d9cfaae02", "comment": "Malware payload (Mirai)", "value": "f7a5c5644284c52faf8b3418cbb0f5c265bf413062273fc2d122a1a276208f2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887215, "uuid": "46c8222d-4a1f-4c1b-a1c2-29a2b15e9699", "comment": "Malware payload (Mirai)", "value": "46502046333d82bd46aaf92a59c9e19f4018d1d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887215, "uuid": "bad91454-d924-45f2-9e28-89a7666a482a", "comment": "Malware payload (Mirai)", "value": "467680aaa52afce21956f2672ad3bb1c6e457b252a9379800df9b159700460e15fbe767e2266985a20ceac3137134da2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887215, "uuid": "649826aa-0a7d-47ee-9175-7312c295e8ca", "value": "T19313F1ACD46C1587C49C4C78D5FE03FC1D1975E5B07A2BDBB7264C2AEE6209318A84BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887215, "uuid": "158b21b2-2e78-42b3-9351-67676d3dd676", "value": "768:W+L9uLi9BOuLeHVCLymBlkcvVgYoGfV9N8pmqUG0PtWIy23r39F7:W+LrJLe1CbscvV/2mqUGay2739F7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638887215, "uuid": "9e67c327-d3e1-4696-a6e6-14a2dd65b89a", "value": 44528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638887215, "uuid": "95534e88-e29d-448c-8b2f-c87f58289b1e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887215, "uuid": "9f9940b7-9fe7-40ec-b8db-ab8c3b135554", "value": "aa0113c8bad240cea24e20d7ac2172c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b532e4-575c-11ec-96a4-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1638881467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881467, "uuid": "74759265-2cb5-47d5-a726-aa589f60663b", "comment": "Malware payload (RedLineStealer)", "value": "f1ea8c489b66edd67b4eb1d103d64140", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881467, "uuid": "eebcab2f-eb79-4e87-ad1f-0342b4b54084", "comment": "Malware payload (RedLineStealer)", "value": "f8daaa065a27508babcd8e898c3f1eda824531105cdcf07ceceee2fda53d5a5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881467, "uuid": "62d56698-0a1c-480e-b887-af89257bc6e5", "comment": "Malware payload (RedLineStealer)", "value": "183a88297c47ed713c001fff172d752a3cf0a9fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881467, "uuid": "0fcaea74-98c7-42fa-8b29-3e2bb3952614", "comment": "Malware payload (RedLineStealer)", "value": "3e79c62cfa330e74ce6228ed74d0fbd8ebec2b087bbadec8296e95d9ab88be3f6414f4fe8473d013b98cea0742726d68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881467, "uuid": "d6884183-b453-41a3-821b-2107da3ab8b6", "value": "T1AA94BF00EAA0C035F1B312F85A759368A93F7AE19B7494CF53D526EA5B74AD0EC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881467, "uuid": "0c89ce29-b691-464d-8492-a8aca74b611f", "value": "bd61429d86f194f3b84d97af55b8c371", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881467, "uuid": "9ffa9db8-bc81-4970-b939-8495e3b22867", "value": "12288:9OirJ8JTcZ5mJNGMnlbbuNlMEcc44uTpU:pwTc7INVdcqU8TW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881467, "uuid": "fa1a4aa7-f0a5-4cba-9726-8db443ba9f53", "value": 431104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881467, "uuid": "62029183-f1d6-4bb8-995c-38d0e05dba67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881467, "uuid": "66deef86-b106-443c-98cc-a5e3c36bb9c1", "value": "f1ea8c489b66edd67b4eb1d103d64140.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea87fa6-575d-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638882041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882041, "uuid": "fdbe8ee6-cc7a-473d-b49c-d747f68fe15f", "comment": "Malware payload", "value": "5faa5f35f1aeed3ba475b7d008ebe396", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882041, "uuid": "9f21f557-539b-4c8a-a2a8-0a8287d0441a", "comment": "Malware payload", "value": "fa1ed680d9b2ef68d145d9697fcb20d29f28a3eea67b7749aca29d14d4c6a128", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882041, "uuid": "a20eb04c-a929-4b26-831f-ad0e928b13cb", "comment": "Malware payload", "value": "d68217c1db1e02c4fbcc12178efa64522beff3b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882041, "uuid": "ad8fd41a-b34d-49fd-b244-7181fdb0afe0", "comment": "Malware payload", "value": "f887d49f6a21ed6a39c804e340c4f54596ddfff62c0a737ca98dbb5279f4f522a9d5ba1fd70d8e9124abe1efa717afa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882041, "uuid": "5a75acb9-83c9-4393-a779-8bf8548d4db1", "value": "T111478C1373A50195E5B3C278C9AA4213D773B8624730CBDF326D12192FB7AE09A7E761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882041, "uuid": "6792a7a5-7200-4a1b-b249-44b0100ae5ed", "value": "28ff79b46830cbe2077464e6595cec49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882041, "uuid": "38368133-69bd-4aa3-848f-e1c2fd3b1e65", "value": "393216:cDCB1VniF1n4QsSiubGkJVCENS/FvfZ/FbuQuZ2BObfagYJMAI7:chPp4NBObiWAI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638882041, "uuid": "563c034f-2590-483d-a699-4ffeef1db0d3", "value": 27033467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638882041, "uuid": "b72c9b22-77df-466c-8bcf-f27e33cac3e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882041, "uuid": "39caa449-ed80-4ecd-864a-78ce46610392", "value": "Askara.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb61753-5786-11ec-96a4-42010a9c0029", "comment": "Malware payload (Zeppelin)", "timestamp": 1638899620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899620, "uuid": "6b1986d9-c997-4067-b3e1-e50cd5277c83", "comment": "Malware payload (Zeppelin)", "value": "9f06f66560bbb04900e3acb8fbc15aff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "Zeppelin", "colour": "#9BEC2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899620, "uuid": "56ba0952-9fc8-471e-9731-d8837e868095", "comment": "Malware payload (Zeppelin)", "value": "fb80bbea1c179bf695c6817b78306696ebb474e4a2e49ce2e38b819338d43d49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "Zeppelin", "colour": "#9BEC2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899620, "uuid": "2529ddbc-17d9-4539-aa89-17955fe5c8ab", "comment": "Malware payload (Zeppelin)", "value": "902fa0c3644add69484b22ed5a809c2f52c0704c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "Zeppelin", "colour": "#9BEC2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638899620, "uuid": "38b659e3-f37c-42bc-9409-157db9980c15", "comment": "Malware payload (Zeppelin)", "value": "154c2300c9dfe87c4e2907dd4dbd901215834ff8e5c110e5c72b981a717cc3db01fe774630bfd3822692fcfc140f59b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "Zeppelin", "colour": "#9BEC2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899620, "uuid": "8f0d3b71-620a-415d-950b-ea702179e065", "value": "T1A444E0DAFC0ACC25E2CEB931042A4F48733BED1A1761E64635673B41597B1F0249AFE8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899620, "uuid": "430a4be5-bfa5-4df7-9014-2e706f0a6234", "value": "f7023dd7fb9e445f38fcd83e7edb3f9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899620, "uuid": "aadd0e99-ff42-45ce-8c9d-23eb0abdad9f", "value": "6144:PWfM6iKwtADM5njFGKfi/Xm51QCG8VG1XhmIQ4i:+l0LnjFGKf351rGagwh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638899620, "uuid": "fce05a43-9847-4e78-8ac9-9655b8a5cf3b", "value": 256039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638899620, "uuid": "0f28ca5b-c776-4974-8739-d3d59660f1ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638899620, "uuid": "2a8154a2-cf64-42da-889d-cf093d799b96", "value": "13098.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38160637-5727-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638858649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638858649, "uuid": "909d20a9-e459-4f31-9ae4-767048877aaf", "comment": "Malware payload (Formbook)", "value": "f0c16143de72e4f0b05549fa02359520", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638858649, "uuid": "02dd461b-e219-4e40-9e45-a368a0d3d9b5", "comment": "Malware payload (Formbook)", "value": "fbeb936c8be6806223ee86138ecb3bcf291b2c4b03f3acc2eb895de0701c7393", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638858649, "uuid": "3db97e4c-9730-4032-92e7-5b5fe2ed1e55", "comment": "Malware payload (Formbook)", "value": "be9ce68422f9aa8da1b16779e964231deee42892", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638858649, "uuid": "b37846f1-a0de-40d5-9923-f478d05f6c59", "comment": "Malware payload (Formbook)", "value": "fec0f30c4994a703293c89dea7b722cfc52f7044085c14ff64ddfd07b5a8141d59aedb7eb5f3a43bdefd1d99f4b0bd26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638858649, "uuid": "f88e02bb-6c68-49a2-9b48-ab86626ab38e", "value": "T12D25234222DCCB55D56C1FF9952002B00BF07D5E9815FBA6DEE2A1F81F6770C8A52A8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638858649, "uuid": "ac83981e-2da4-4750-83f6-190ec0052b15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638858649, "uuid": "3ff0da2d-f34c-4130-856b-cb1f1534fc89", "value": "24576:p0Arr9sRLeflUnnayBXjsP2zxoM1s8UuigEarYh0nL:pXr9sk9UnnaixxMu58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638858649, "uuid": "e9780e21-2370-4bc6-beff-b3649165c1a6", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638858649, "uuid": "71e2747f-dfa1-4f75-973a-d1257c03c19f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638858649, "uuid": "fec43f85-e7d8-40a6-8123-43dd13b080cf", "value": "E-dekont Ziraat Bankas\u0131.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c447aa-575e-11ec-96a4-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1638882529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882529, "uuid": "7123d7b7-8166-45e8-bfbb-a54bb6e07d00", "comment": "Malware payload (SnakeKeylogger)", "value": "b110b1c192d9ceddfcac467a2612fbc5", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882529, "uuid": "4b9294b4-b571-43bb-b8be-19a081a6bf2c", "comment": "Malware payload (SnakeKeylogger)", "value": "fc811ae78b2a99a10bbdab1b4d5930ce3453c697b5e73a4d3f209028a43c27ad", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882529, "uuid": "713b8d53-328f-4fa4-b62b-26225025a994", "comment": "Malware payload (SnakeKeylogger)", "value": "4ef16d4d2f6b4d63d0e2eb7680b3a0a4c5120377", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638882529, "uuid": "09d51175-8d12-405b-aa38-e716f6fcc255", "comment": "Malware payload (SnakeKeylogger)", "value": "a4ce14e0741a4f68f692dfbf16ce670b1cf5baaa58a3b5968dc894d95161d865feb8a73719af08f0c84f385c86a326fc", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882529, "uuid": "b6830c01-6f03-49db-8468-4c505371118e", "value": "T10813F25F672E585E099670203BA570C3588D56CEE0B11EC0D20E5B3AB3A792777E6EF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882529, "uuid": "899d639a-a3ed-400a-89d9-d6405bad7f12", "value": "768:YoBlk5+a6SjSTvd2qG8U9NXBDDsKnFBV7+3X7Hya6hvnqHsaB6r1tUCqtUDPU:Z45+V82UvBPsKFX7+7Hya6hvqLB2qp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638882529, "uuid": "2bd95f37-4c05-4ab1-8934-1d7efe2ce153", "value": 42552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638882529, "uuid": "f6f13d63-13d0-4e7f-8c83-89e36ea7fee5", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638882529, "uuid": "86937e78-83a8-4a1b-bfbb-c151cc29f3e8", "value": "print_01.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a861583-573d-11ec-96a4-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1638868263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868263, "uuid": "7aa1f215-17d1-4c97-9669-c8e19805f168", "comment": "Malware payload (Dridex)", "value": "fb1f72f39a57bad55a79610a9d046438", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868263, "uuid": "cdd26b04-96e9-4366-ae52-a21ac3ddf9a2", "comment": "Malware payload (Dridex)", "value": "fd260864be7fd772d604b35b8a25c705a9215dcfb8818cdd3abbb4b58e7dee59", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868263, "uuid": "23d89809-66b5-4f9c-865b-874f059c3b04", "comment": "Malware payload (Dridex)", "value": "223d18a5fe22171e6e3155e03cc6051483552f39", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638868263, "uuid": "d42f0592-5d54-4ff0-a9b2-de412f8ae50d", "comment": "Malware payload (Dridex)", "value": "8928c3ac9fc483d283feff670bef8cfe050a0156160dfb0692f3c795fb6e6c3999f5de2141dcccedefe98f534d948bf5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638868263, "uuid": "821e589c-d651-4af4-a446-1474bb6d1d37", "value": "T19FB3122EC36BB121C07B05FD856F5CB1C033B573D545A5AB9006F88C462A836F6DBB6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638868263, "uuid": "c106ea5e-8810-4f39-b266-7703f7099ee9", "value": "3072:JQ3Hl/FQEZH5o1td/fKxSKREvpER3yPpIMoMG64zp2+kd+X:CV/FkCQBI3TMoMuF2bdU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638868263, "uuid": "f685880c-9306-49e1-ae63-a1298294eb3a", "value": 115939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638868263, "uuid": "11e6bfd5-c1ec-4710-8683-b060f156dfaf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638868263, "uuid": "078454f4-a0f6-40ec-901e-3758cde8c3b2", "value": "Insurance act 227852.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f783a79a-57a4-11ec-96a4-42010a9c0029", "comment": "Malware payload", "timestamp": 1638912658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912658, "uuid": "b53d3158-a50e-4f09-854f-a179745cf051", "comment": "Malware payload", "value": "945cb494637cf29ca22c43a1971e5093", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912658, "uuid": "ac1e8f6d-2511-43f5-9589-da842d3cbaf5", "comment": "Malware payload", "value": "ff0ba966827ea762bc388a974fa4f9a7909c7beefcaedeb49cab6202b979f5be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912658, "uuid": "f60f532e-d9ff-4f5e-a086-825ccc8c748c", "comment": "Malware payload", "value": "df827e2ec3ddfcfe553f2849f85e679c88aeb0b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638912658, "uuid": "25252ac8-0532-4327-a6f9-642f9a5a39d9", "comment": "Malware payload", "value": "b4d69d49d82ed00c1606418fd3a6a00eabf132bb270d486966239d92341363fe8f7e22b18567f34067c0666313a1291b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912658, "uuid": "e101cc56-c718-46a2-b762-7c55da736900", "value": "T10E3522ACF66792CECA4423BA376A503411367C3AE12BC19CC557728F1D33B157623B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912658, "uuid": "09e36061-7cfa-4e66-97b2-8bb3c0a49b0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912658, "uuid": "be6a57a1-cac3-4776-a573-ac4f0c02062e", "value": "24576:8lg1lOYEHcjKRKLbXif4jmK/tEt6h3daOdaTmlvCkiMQO:tlPEiayyf4yetUOsTm1WfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638912658, "uuid": "c08966c5-097d-4c3d-a800-9096744b22a6", "value": 1134080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638912658, "uuid": "a5b00ba1-5ca4-4494-95fe-81bec70bdad8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638912658, "uuid": "e7e425f8-8f3d-49a8-b617-9e21e473d9d0", "value": "945cb494637cf29ca22c43a1971e5093", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b95706f-5768-11ec-96a4-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1638886519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638886519, "uuid": "1696e926-d9a9-4373-a038-4af5262f4fc5", "comment": "Malware payload (AgentTesla)", "value": "dde6feccc99ae17c95e4c4040bbbd6c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638886519, "uuid": "6024eb80-2001-4702-900b-31cb7caefbb9", "comment": "Malware payload (AgentTesla)", "value": "ff796af344ac818342a4250f191247c5299692f9660f5fb9c4eb64d8bbcbc2af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638886519, "uuid": "62636de0-8ec0-4012-b27e-377a841b8726", "comment": "Malware payload (AgentTesla)", "value": "811027ef97cc422875b84b85403f0f0d7dc163f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638886519, "uuid": "e38d3bb1-2c43-42ef-bf7c-debf50c21c22", "comment": "Malware payload (AgentTesla)", "value": "a1ef1d1675930933638bebc7eafbce307890431e71a9c8aa1c1f5d373cea4e547c35115f8fd95448df150c0ee7d575c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638886519, "uuid": "8606dd00-bf7b-48e9-a14b-0627ee42dca7", "value": "T10435127C3A6363CDE1859375376A847813B33C3A9667D65CE096369F4C33A853633A12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638886519, "uuid": "f9f94c1d-5833-469b-b953-464f4ace2456", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638886519, "uuid": "5175e90f-c1dc-441f-8b2f-e2d0239e2937", "value": "24576:Lql+t4XO6BMDWUg4J4uULA90h4fh06DmtVi2J0:htQ04u8A90MGmns0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638886519, "uuid": "e0c1f19e-bb41-4c88-9839-a7e59ad7499f", "value": 1094144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638886519, "uuid": "8d9ef535-505d-4d95-b20c-55ec3015d30e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638886519, "uuid": "d65691ab-42b7-47e7-ba8f-b1d60eb8adbd", "value": "Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc6c406-575c-11ec-96a4-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1638881473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881473, "uuid": "99de855a-bfd8-4b2c-9f05-cb65a4e4d7f4", "comment": "Malware payload (Formbook)", "value": "dbf11774539ddd5c5040aaa98a78d973", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881473, "uuid": "112c2b62-9629-41ce-a39d-a73b8e5e5a16", "comment": "Malware payload (Formbook)", "value": "ffeca3430402f8d3862b9fbed99a0d376828de09665b4feee38b7231098d9171", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881473, "uuid": "b55cd097-42e9-44f3-8a90-8920705ae2c6", "comment": "Malware payload (Formbook)", "value": "63eeead54a8f863d7c1ada7fe268220b287c7761", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638881473, "uuid": "1a688846-acb6-4764-82d3-037e8e57bb9b", "comment": "Malware payload (Formbook)", "value": "49011a51a0e99404e5ed6120ca39cd81f47c2b9b3e403a9d62c089b2ede6ed6fd14c6cde9a5c81becca7096c3d2e3439", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881473, "uuid": "1b723221-4f63-48ac-8337-6a53a6ce15cb", "value": "T1B03512BC39A327CED852C7B13729806816B67C32161BC1DDE06A328F1D3BB657563B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881473, "uuid": "b6ba51fd-48ff-4874-93ec-f7b19b727804", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881473, "uuid": "9c8d5247-5df6-4f48-849b-ed95b09fedc4", "value": "24576:yf33yyRysmgCqtcYTS7TnRk6nheWdeviSXEY1/LVfKL+:SysJCwSnnRk6hrdev3nC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638881473, "uuid": "0558a6f1-a8b6-4955-95f6-a0b9396e9598", "value": 1066496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638881473, "uuid": "4e4967df-076a-4ec9-ba9d-22697834525e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638881473, "uuid": "e1ff00ee-526b-437c-9f9c-b0194a2f0fc4", "value": "dbf11774539ddd5c5040aaa98a78d973.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1eaf82c-576a-11ec-96a4-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1638887684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887684, "uuid": "bfc548c5-36d9-4d02-8c15-e45c3364935a", "comment": "Malware payload (Mirai)", "value": "b83a724cbd8f03c10f53a9202e808877", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887684, "uuid": "c81e25ee-f5d8-4358-9139-caba173e85ef", "comment": "Malware payload (Mirai)", "value": "ffee4fd0e6edb67fee41999b9e8628d48fba577e2afc80e254403101cfeb9de6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887684, "uuid": "d4b6432f-5ee0-4f97-96fb-2c58eb772998", "comment": "Malware payload (Mirai)", "value": "81f5abff93971f7097ec9f7f75df9e74faade701", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1638887684, "uuid": "89c76585-629a-4097-9985-0bd6760dd643", "comment": "Malware payload (Mirai)", "value": "b3179afddebb5a01c0efa6c7c39b53b91e0ee1f9e05e57a7b215c100710d4367969aa17f18448be15ec7ef62d81231f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887684, "uuid": "27056a75-c0fc-442c-83cc-ae7ea4e7c053", "value": "T1EA13F2750A056BF3F315017A9E3ADB442110A066F33AF7621A5B08E9CB97E4F752B743", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887684, "uuid": "47b4893e-6af6-4634-a058-5af3274ca889", "value": "768:MGHhD9hoIbJsXYL/+H5IDcyuJhh+9bS/kg063MTOUjeFiwAWs3UozhJ8sJv0IEU:MGBD9ZGI7G5+cyu/hWg3mjqiwKzEFI3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1638887684, "uuid": "bde7ec84-e51c-495e-8d0c-80f0eb9a6297", "value": 43980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1638887684, "uuid": "6caa159a-4572-40fc-a8f3-79755c70fdf1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1638887684, "uuid": "7b55df6f-c21a-4f25-a247-d1b5df7a6342", "value": "b83a724cbd8f03c10f53a9202e808877", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }